PT-2025-25520 · Libxml2+11 · Libxml2+11

Nikita Sveshnikov · Published 2025-01-01 · Updated 2026-03-01 · CVE-2025-49794

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions libxml2 versions (affected versions not specified)

Description A use-after-free issue was found in libxml2, occurring when parsing XPath elements under certain circumstances, specifically when the XML schematron contains the "sch:name path" schema elements. This allows a malicious actor to craft a malicious XML document, potentially causing the program to crash or resulting in undefined behaviors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Use After Free

Weakness Enumeration

CWE-825

CWE-416

Related Identifiers

ALSA-2025:10630

ALSA-2025:10698

ALSA-2025:10699

AZL-64095

AZL-64127

BDU:2025-08979

CESA-2025_10698

CVE-2025-49794

DLA-4251-1

ECHO-87D5-BEF1-89B5

GHSA-353F-X4GH-CQQ8

INFSA-2025_10698

INFSA-2025_10699

MGASA-2025-0269

OESA-2025-1768

OESA-2025-1769

OESA-2025-1770

OESA-2025-1898

OESA-2025-1899

OESA-2025-1900

OPENSUSE-SU-2025:15321-1

RHSA-2025:10630

RHSA-2025:10698

RHSA-2025:10699

RHSA-2025:11580

RHSA-2025:12098

RHSA-2025:12099

RHSA-2025:12199

RHSA-2025:12237

RHSA-2025:12239

RHSA-2025:12240

RHSA-2025:12241

RHSA-2025_10698

RHSA-2025_10699

RHSA-2026:7519

SUSE-SU-2025:02260-1

SUSE-SU-2025:02275-1

SUSE-SU-2025:02294-1

SUSE-SU-2025:02314-1

SUSE-SU-2025:02355-1

SUSE-SU-2025:20564-1

SUSE-SU-2025:20607-1

SUSE-SU-2025_02260-1

SUSE-SU-2025_02275-1

SUSE-SU-2025_02294-1

SUSE-SU-2025_02314-1

SUSE-SU-2025_02355-1

USN-7694-1

Affected Products

Almalinux

Astra Linux

Centos

Debian

Ibm Aix

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libxml2

References · 153

• https://access.redhat.com/errata/RHSA-2025:19046 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15321-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:12239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49795 · Security Note
• https://osv.dev/vulnerability/AZL-64127 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2025:18218 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02275-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2025-10630.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:10698 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-49794 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1899 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-49796 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory