XML::LibXML versions through 2.0210 for Perl contain an out‑of‑bounds heap memory read (CWE‑125) that occurs when the parser processes XML node names that contain a truncated UTF‑8 byte sequence. The bug causes the parser to read past the end of the input string into adjacent heap memory, leading to a crash of the Perl process. The likely consequence is a denial of service for any application that uses XML::LibXML’s DOM node‑name methods with attacker‑controlled input.

The affected product is SHLOMIF’s Perl module XML::LibXML. Any installation of XML::LibXML version 2.0210 or earlier is vulnerable; newer releases are not affected.

The flaw does not involve direct code execution, but it allows a remote or local attacker who can supply crafted XML to cause a process crash, impacting availability. No CVSS score is listed, EPSS is not available and the vulnerability is not included in the CISA KEV catalog, so the exploitation likelihood is uncertain; however, the attack vector requires the target application to parse untrusted XML data, which is common in web services and data interchange scenarios.