CVE-2025-49794

CriticalCVSS 9.1/10Last modified Oct 12, 2026

Description

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-825

Affected software

No affected versions have been published.

Timeline

Published: Jun 16, 2025
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-497957.5A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a CVE-2025-497969.1A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. Th CVE-2025-497978.5Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be execu CVE-2025-49805.3A vulnerability has been found in Netgear DGND3700 1.1.00.15_1.00.15NA and classified as problematic. This vulnerability affects unknown cod CVE-2025-498097.8mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: CVE-2025-49819.9Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to sanitize filenames in CVE-2025-498104.3Mattermost versions 10.5.x <= 10.5.8 fail to validate access controls at time of access which allows user to read a thread via AI posts CVE-2025-498127.4In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle CVE-2025-498137.2An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC ve CVE-2025-498230.0(conda) Constructor is a tool which allows constructing an installer for a collection of conda packages. Prior to version 3.11.3, shell inst CVE-2025-498241.7conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. P CVE-2025-498259.8Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and includin