# CVE-2025-49794: Libxml: heap use after free (uaf) leads to denial of service (dos)

Status: published. Published: 2025-06-16. Updated: 2026-11-04.

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

## Remediation

- workaround: There's no available mitigation other than avoid processing untrusted XML documents before updating to the libxml version containing the fix. (source: CNA: redhat)

## Affected products and versions

-  /  (libxml2): ≥ 0; < 2.15.0 (affected, semver). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (libxml2): ≥ 0:2.12.5-7.el10_0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 Extended Lifecycle Support (libxml2): ≥ 0:2.9.1-6.el7_9.10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (libxml2): ≥ 0:2.9.7-21.el8_10.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support (libxml2): ≥ 0:2.9.7-9.el8_2.3; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (libxml2): ≥ 0:2.9.7-9.el8_4.6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On (libxml2): ≥ 0:2.9.7-9.el8_4.6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (libxml2): ≥ 0:2.9.7-13.el8_6.10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Telecommunications Update Service (libxml2): ≥ 0:2.9.7-13.el8_6.10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions (libxml2): ≥ 0:2.9.7-13.el8_6.10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service (libxml2): ≥ 0:2.9.7-16.el8_8.9; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (libxml2): ≥ 0:2.9.7-16.el8_8.9; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (libxml2): ≥ 0:2.9.13-10.el9_6; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions (libxml2): ≥ 0:2.9.13-1.el9_0.5; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (libxml2): ≥ 0:2.9.13-3.el9_2.7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.4 Extended Update Support (libxml2): ≥ 0:2.9.13-10.el9_4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat JBoss Core Services 2.4.62.SP2 (libxml2): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.12 (openshift/ose-rhel-coreos-8): ≥ 412.86.202510291903-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.13 (openshift/ose-rhel-coreos-9): ≥ 413.92.202510150118-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.14 (openshift/ose-rhel-coreos-9): ≥ 414.92.202510211419-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.15 (openshift/ose-rhel-coreos-9): ≥ 415.92.202609140326-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.16 (openshift/ose-rhel-coreos-9): ≥ 416.94.202609011112-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.17 (openshift/ose-rhel-coreos-9): ≥ 417.94.202510112152-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.18 (openshift/ose-rhel-coreos-9): ≥ 418.94.202510230424-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.19 (openshift/ose-rhel-coreos-9): ≥ 4.19.9.6.202510140714-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.20 (openshift/ose-rhel-coreos-9): ≥ 4.20.9.6.202509251656-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Web Terminal 1.11 on RHEL 9 (web-terminal/web-terminal-rhel9-operator): ≥ 1.11-19; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Web Terminal 1.11 on RHEL 9 (web-terminal/web-terminal-tooling-rhel9): ≥ 1.11-8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Web Terminal 1.12 on RHEL 9 (web-terminal/web-terminal-tooling-rhel9): ≥ 1.12-4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-data-index-ephemeral-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-data-index-postgresql-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-db-migrator-tool-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-jobs-service-ephemeral-rhel8): ≥ 1.36.0-10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-jobs-service-postgresql-rhel8): ≥ 1.36.0-10; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8): ≥ 1.36.0-4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-management-console-rhel8): ≥ 1.36.0-9; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-operator-bundle): ≥ 1.36.0-12; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-rhel8-operator): ≥ 1.36.0-18; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-swf-builder-rhel8): ≥ 1.36.0-11; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / RHOSS-1.36-RHEL-8 (openshift-serverless-1/logic-swf-devmode-rhel8): ≥ 1.36.0-7; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / cert-manager operator for Red Hat OpenShift 1.16 (cert-manager/jetstack-cert-manager-rhel9): ≥ v1.16.5-1760515757; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / OpenShift File Integrity Operator - FIO 1 (compliance/openshift-file-integrity-rhel8-operator): ≥ v1.3; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (libxml2-main): ≥ 2.15.2-0.3.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Insights proxy 1.5 (insights-proxy/insights-proxy-container-rhel9): ≥ 1.5.5-1754504343; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat 3scale API Management Platform 2 (3scale-amp2/system-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat 3scale API Management Platform 2 (3scale-amp2/zync-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (libxml2): Version range not reported. Source: CNA: redhat
- Siemens / RUGGEDCOM ROX MX5000: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX MX5000RE: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1400: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1500: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1501: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1510: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1511: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1512: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1524: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX1536: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM ROX RX5000: ≥ 0; < V2.17.1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM RST2428P: ≥ 0; < V4.0 (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CVSS 3.1: 9.1 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H; source: CNA: redhat

- CVSS 3.1: 9.1 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.83% as of 2026-11-04; percentile 57.76%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-825

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2025:10630 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:10698 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:10699 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:11580 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:12098 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:12099 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:12199 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:12237 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:12239 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:12240 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:12241 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:13335 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15397 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15827 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:15828 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:18217 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:18218 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:18219 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:18240 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:19020 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:19041 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:19046 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:19894 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2025:21913 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:0934 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:62549 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:67857 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:7519 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2025-49794 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2372373 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://gitlab.gnome.org/GNOME/libxml2/-/issues/931 (CNA: redhat)

- https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html (ADP: CVE)

- https://cert-portal.siemens.com/productcert/html/ssa-577017.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-253495.html (ADP: siemens-SADP)

- https://access.redhat.com/errata/RHSA-2025:10630 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:10698 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:10699 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:11580 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:12098 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:12099 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:12199 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:12237 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:12239 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:12240 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:12241 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:13335 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:15397 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:15827 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:15828 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:18217 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:18218 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:18219 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:18240 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:19020 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:19041 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:19046 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:19894 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2025:21913 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:0934 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:62549 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:67857 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:7519 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2025-49794 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2372373 (secalert@redhat.com)

- https://gitlab.gnome.org/GNOME/libxml2/-/issues/931 (secalert@redhat.com)

- https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html (af854a3a-2127-422b-91ae-364da2661108)

- https://cert-portal.siemens.com/productcert/html/ssa-253495.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)

- https://cert-portal.siemens.com/productcert/html/ssa-577017.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2025-49794; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-49794; retrieved 2026-11-05; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-49794; retrieved 2026-11-04; source updated Not reported

Revision: f306351e40e338c7cc8129f2d6247d72ffc1564240eaf0ef3a622fee135bb402

Canonical: https://y2.dev/cve/CVE-2025-49794

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.