Nokogiri, a widely used XML parsing library for Ruby, contains a stack buffer overflow in libxml2 when reporting DTD validation errors that involve long QName prefixes, and a use‑after‑free during validation against untrusted XML Schemas. An attacker can supply malicious DTD content or untrusted XSD files to the library, which can trigger a denial of service or potentially uncontrolled code execution, depending on the environment.

The affected product is the Nokogiri library, maintained by Sparklemotion. Versions earlier than 1.18.3 are impacted; applications that depend on any of these versions are vulnerable. The vulnerability is present in any environment where the library performs DTD validation or schema validation on input that could be supplied by an attacker.

The CVSS score is 9.3, indicating a critical severity. EPSS data is not available, so the current probability of exploitation is unknown, but the absence of an EPSS score does not reduce the inherent risk. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through any component that loads XML, DTD, or XSD data from an external source, prompting the library to perform validation. If such processing occurs in a privileged context or the application trusts the data, the stack overflow or use‑after‑free can lead to remote code execution. Applications that cannot mitigate these checks at runtime are at high risk.