Description
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
Metrics
CVSS 3.1 9.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| — | — | < 2.15.0 |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — |
| Red Hat | Red Hat JBoss Core Services 2.4.62.SP2 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — |
| Red Hat | Red Hat Web Terminal 1.12 on RHEL 9 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | cert-manager operator for Red Hat OpenShift 1.16 | — |
| Red Hat | OpenShift File Integrity Operator - FIO 1 | — |
| Red Hat | Red Hat Hardened Images | — |
| Red Hat | Red Hat Insights proxy 1.5 | — |
| Red Hat | Red Hat 3scale API Management Platform 2 | — |
| Red Hat | Red Hat 3scale API Management Platform 2 | — |
| Red Hat | Red Hat Enterprise Linux 6 | — |
| Siemens | RUGGEDCOM ROX MX5000 | < V2.17.1 |
References
- https://access.redhat.com/errata/RHSA-2025:10630
- https://access.redhat.com/errata/RHSA-2025:10698
- https://access.redhat.com/errata/RHSA-2025:10699
- https://access.redhat.com/errata/RHSA-2025:11580
- https://access.redhat.com/errata/RHSA-2025:12098
- https://access.redhat.com/errata/RHSA-2025:12099
- https://access.redhat.com/errata/RHSA-2025:12199
- https://access.redhat.com/errata/RHSA-2025:12237
- https://access.redhat.com/errata/RHSA-2025:12239
- https://access.redhat.com/errata/RHSA-2025:12240
- https://access.redhat.com/errata/RHSA-2025:12241
- https://access.redhat.com/errata/RHSA-2025:13335
- https://access.redhat.com/errata/RHSA-2025:15397
- https://access.redhat.com/errata/RHSA-2025:15827
- https://access.redhat.com/errata/RHSA-2025:15828
- https://access.redhat.com/errata/RHSA-2025:18217
- https://access.redhat.com/errata/RHSA-2025:18218
- https://access.redhat.com/errata/RHSA-2025:18219
- https://access.redhat.com/errata/RHSA-2025:18240
- https://access.redhat.com/errata/RHSA-2025:19020
- https://access.redhat.com/errata/RHSA-2025:19041
- https://access.redhat.com/errata/RHSA-2025:19046
- https://access.redhat.com/errata/RHSA-2025:19894
- https://access.redhat.com/errata/RHSA-2025:21913
- https://access.redhat.com/errata/RHSA-2026:0934
- https://access.redhat.com/errata/RHSA-2026:62549
- https://access.redhat.com/errata/RHSA-2026:67857
- https://access.redhat.com/errata/RHSA-2026:7519
- https://access.redhat.com/security/cve/CVE-2025-49794
- https://bugzilla.redhat.com/show_bug.cgi?id=2372373
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/931
- https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
- https://cert-portal.siemens.com/productcert/html/ssa-577017.html
Timeline
- Published
- Jun 16, 2025
- Last modified
- Nov 4, 2026
- NVD status
- Deferred