Use-After-Free Vulnerability in libxml2 Affects Red Hat Products
CVE-2025-49794

9.1CRITICAL

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
16 June 2025

What is CVE-2025-49794?

A use-after-free vulnerability has been identified in libxml2, which specifically manifests when parsing XPath elements in the presence of the <sch:name path="..."/> schema elements within an XML schematron. This flaw can be exploited by a malicious actor to create a specially crafted XML document that, when processed by libxml2, may cause the application to crash or potentially lead to unpredictable behaviors. This vulnerability highlights the need for proper input validation and error handling in XML processing routines.

References

https://access.redhat.com/security/cve/CVE-2025-49794
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2372373
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49794 : Use-After-Free Vulnerability in libxml2 Affects Red Hat Products