Vulnerability record/PUBLISHED/Published Jun 16, 2025 15:24:31 UTC
CVE-2025-49794
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
Base score9.1/ 10
SeverityCriticalCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 4, 2026 21:35:53 UTC
PublishedJun 16, 2025 15:24:31 UTC
ReservedJun 10, 2025 22:17:05 UTC