UAF in libxml2 XPath Parsing via sch:name Path (CVE-2025-49794)
CVE-2025-49794 Published on June 16, 2025

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

Github Repository Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2025-49794 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Dangling pointer Vulnerability?

The program dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid. When a program releases memory, but it maintains a pointer to that memory, then the memory might be re-allocated at a later time. If the original pointer is accessed to read or write data, then this could cause the program to read or modify data that is in use by a different function or process. Depending on how the newly-allocated memory is used, this could lead to a denial of service, information exposure, or code execution.

CVE-2025-49794 has been classified to as a Dangling pointer vulnerability or weakness.


Products Associated with CVE-2025-49794

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2025-49794 are published in these products:

Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel Els
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel E4s
 
Red Hat Rhel Tus
 
Red Hat Rhel Eus
 
Red Hat Webterminal
 
Red Hat Insights Proxy
 
Red Hat Jboss Core Services
 
Red Hat Openshift
 
Red Hat Rhivos
 
Red Hat Cert Manager
 
Oracle
 
Red Hat Http Server
 
Red Hat Openshift File Integrity Operator
 

Vulnerable Packages

The following package name and versions may be associated with CVE-2025-49794

Package Manager Vulnerable Package Versions Fixed In
rubygems nokogiri < 1.18.9 1.18.9

Exploit Probability

EPSS
0.26%
Percentile
49.52%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.