CVE-2025-49794

CRITICAL

libxml2 - Use After Free

Title source: llm
STIX 2.1

Description

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

Scores

CVSS v3 9.1
EPSS 0.0044
EPSS Percentile 63.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-825
Status published
Products (43)
Red Hat/cert-manager operator for Red Hat OpenShift 1.16 sha256:1abdfac084e7c86e7a93a19e5cf6b54db79b903bfb7474a42200f753b29eda4b
Red Hat/cert-manager operator for Red Hat OpenShift 1.16 sha256:df852ad92734bc087e213e6c7075daf6d7010db4ab72919649736804e295a6a2
Red Hat/File Integrity Operator 1 sha256:364d11af112a5b1d3f28c9ea8b7aac678e111b9c7fca0516d61036904f318605
Red Hat/File Integrity Operator 1 sha256:59fcdf4ea159ba76fdb582011263672646dd9d63304a91592c0a21d0f43986a4
Red Hat/File Integrity Operator 1 sha256:86d2378dea6c26da92e19e1a8dc9c9fb0fa8587fd60f83e6cc4503153e753db9
Red Hat/Red Hat Enterprise Linux 10 0:2.12.5-7.el10_0
Red Hat/Red Hat Enterprise Linux 6
Red Hat/Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.9.1-6.el7_9.10
Red Hat/Red Hat Enterprise Linux 8 0:2.9.7-21.el8_10.1
Red Hat/Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.9.7-9.el8_2.3
... and 33 more
Published Jun 16, 2025
Tracked Since Feb 18, 2026