CVE-2025-49794
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A use-after-free vulnerability was found in libxml2 when parsing XPath elements under certain circumstances with XML schematron containing <sch:name path="..."/> elements. This flaw allows a malicious actor to craft a malicious XML document that, when processed by libxml, can cause program crashes or other undefined behaviors.
Risk Assessment
The organization faces the risk of application crashes in software using libxml2 for XML processing, potentially leading to denial of service (DoS) or other unspecified dangerous system behaviors.
Recommendation
Immediately update libxml2 to the latest patched version. Until the update is applied, avoid processing untrusted XML documents containing schematron elements.
Other vulnerabilities in libxml2
See all- CVE-2017-16932High
The parser.c file in libxml2 before version 2.9.5 does not prevent infinite recursion in parameter entities.
- CVE-2017-7013High
An issue was discovered in certain Apple products related to the 'libxml2' component. Affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, tvOS before 10.2.2, and watchOS before 3.2.3.
- CVE-2017-7010High
An issue was discovered in certain Apple products related to the 'libxml2' component. It affects iOS before 10.3.3, macOS before 10.12.6, iCloud before 6.2.2 on Windows, iTunes before 12.6.2 on Windows, and tvOS before 10.2.2.
- CVE-2017-0663High
A remote code execution vulnerability in libxml2 could allow an attacker to execute arbitrary code within the context of an unprivileged process. This issue affects applications using this library on Android.
- CVE-2017-9050High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash. The issue exists due to an incomplete fix for CVE-2016-1839.
- CVE-2017-9049High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c. This vulnerability causes programs that use libxml2, such as PHP, to crash.
- CVE-2017-9048High
libxml2 version 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow. The function xmlSnprintfElementContent in valid.c may strcat two more characters to the buffer without checking if the size allows it.
- CVE-2017-9047High
A buffer overflow was discovered in the libxml2 library in the xmlSnprintfElementContent function, which can lead to writing data beyond allocated memory. The issue arises when the buffer length check does not account for the updated length after appending the prefix.
- CVE-2016-4483High
The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.
- CVE-2016-4449High
CVE-2016-4449 describes an XXE vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before version 2.9.4. This vulnerability, when not in validating mode, allows attackers to read arbitrary files or cause denial of service through unspecified vectors.
Original NVD description (English source)
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.