CVE-2025-49794

Published Jun 16, 2025

Last updated 9 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-49794 is a use-after-free vulnerability found in libxml2. This vulnerability occurs when parsing XPath elements specifically when the XML schematron contains the `<sch:name path="..." />` schema elements. A malicious actor can exploit this flaw by crafting a malicious XML document, which, when used as input for libxml, can cause the program using libxml2 to crash or exhibit other undefined behaviors.

Description: A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
Source: secalert@redhat.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity: CRITICAL

Weaknesses

secalert@redhat.com: CWE-825

Hype score: Not currently trending

References