CVE-2025-49794

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49794
Downstream
ALPINE (1)
AZL (2)
BELL (1)
CLSA (11)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (6)
openSUSE (1)
RHSA (12)
RLSA (3)
SUSE (7)
UBUNTU (1)
Related
ALSA (3)
openSUSE (1)
SUSE (7)
Published
2025-06-16T15:24:31Z
Modified
2026-10-21T09:17:53Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Libxml: heap use after free (uaf) leads to denial of service (dos)
Details

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

Database specific 
{
    "cna_assigner":  "redhat",
    "cwe_ids":  [
        "CWE-825"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49794.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "fixed":  "0:2.12.5-7.el10_0"
                        },
                        {
                            "fixed":  "0:2.9.1-6.el7_9.10"
                        },
                        {
                            "fixed":  "0:2.9.7-21.el8_10.1"
                        },
                        {
                            "fixed":  "0:2.9.7-21.el8_10.1"
                        },
                        {
                            "fixed":  "0:2.9.7-9.el8_2.3"
                        },
                        {
                            "fixed":  "0:2.9.7-9.el8_4.6"
                        },
                        {
                            "fixed":  "0:2.9.7-9.el8_4.6"
                        },
                        {
                            "fixed":  "0:2.9.7-13.el8_6.10"
                        },
                        {
                            "fixed":  "0:2.9.7-13.el8_6.10"
                        },
                        {
                            "fixed":  "0:2.9.7-13.el8_6.10"
                        },
                        {
                            "fixed":  "0:2.9.7-16.el8_8.9"
                        },
                        {
                            "fixed":  "0:2.9.7-16.el8_8.9"
                        },
                        {
                            "fixed":  "0:2.9.13-10.el9_6"
                        },
                        {
                            "fixed":  "0:2.9.13-10.el9_6"
                        },
                        {
                            "fixed":  "0:2.9.13-1.el9_0.5"
                        },
                        {
                            "fixed":  "0:2.9.13-3.el9_2.7"
                        },
                        {
                            "fixed":  "0:2.9.13-10.el9_4"
                        },
                        {
                            "fixed":  "412.86.202510291903-0"
                        },
                        {
                            "fixed":  "413.92.202510150118-0"
                        },
                        {
                            "fixed":  "414.92.202510211419-0"
                        },
                        {
                            "fixed":  "415.92.202609140326-0"
                        },
                        {
                            "fixed":  "416.94.202609011112-0"
                        },
                        {
                            "fixed":  "417.94.202510112152-0"
                        },
                        {
                            "fixed":  "418.94.202510230424-0"
                        },
                        {
                            "fixed":  "4.19.9.6.202510140714-0"
                        },
                        {
                            "fixed":  "4.20.9.6.202509251656-0"
                        },
                        {
                            "fixed":  "1.11-19"
                        },
                        {
                            "fixed":  "1.11-8"
                        },
                        {
                            "fixed":  "1.12-4"
                        },
                        {
                            "fixed":  "1.36.0-11"
                        },
                        {
                            "fixed":  "1.36.0-11"
                        },
                        {
                            "fixed":  "1.36.0-11"
                        },
                        {
                            "fixed":  "1.36.0-10"
                        },
                        {
                            "fixed":  "1.36.0-10"
                        },
                        {
                            "fixed":  "1.36.0-4"
                        },
                        {
                            "fixed":  "1.36.0-9"
                        },
                        {
                            "fixed":  "1.36.0-12"
                        },
                        {
                            "fixed":  "1.36.0-18"
                        },
                        {
                            "fixed":  "1.36.0-11"
                        },
                        {
                            "fixed":  "1.36.0-7"
                        },
                        {
                            "fixed":  "v1.16.5-1760515757"
                        },
                        {
                            "fixed":  "2.15.2-0.3.hum1"
                        },
                        {
                            "fixed":  "1.5.5-1754504343"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / gitlab.gnome.org/gnome/libxml2

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/libxml2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0bea77c8289324483c0504d36ac730bb03f6a70b
Fixed
97fea18b7138caf76bf17d003f4985d8797d26f9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.15.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "v1.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "InverseAffectedRanges"
        }
    ]
}

Affected versions

Other
FOR_GNOME_0_99_1
GNOME_0_30
GNUMERIC_FIRST_PUBLIC_RELEASE
LIBXML_0_99
LIB_XML_1_1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49794.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "257367616524644363065775477338570909958",
            "length":  450
        },
        "id":  "CVE-2025-49794-269be83b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@97fea18b7138caf76bf17d003f4985d8797d26f9",
        "target":  {
            "file":  "parser.c",
            "function":  "xmlSAXParseDoc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "128204593758245842800144810537873211851",
            "length":  634
        },
        "id":  "CVE-2025-49794-2f2f7262",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@97fea18b7138caf76bf17d003f4985d8797d26f9",
        "target":  {
            "file":  "parser.c",
            "function":  "xmlInitParserCtxt"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "201842734386694817774867162999628396339",
                "294703210077859002985091933762133344654",
                "210206041985135136950194436965688247356",
                "273017952127347794324505716363446942479",
                "187544579095596215171992492528163891959",
                "208061949709105959564784786381474356863",
                "272153902835007740041565734838148937364",
                "254787417024363648891162367490320479852",
                "99503184872681000242331937762802689386",
                "294703210077859002985091933762133344654",
                "210206041985135136950194436965688247356",
                "273017952127347794324505716363446942479",
                "201842734386694817774867162999628396339",
                "294703210077859002985091933762133344654",
                "210206041985135136950194436965688247356",
                "273017952127347794324505716363446942479",
                "201842734386694817774867162999628396339",
                "294703210077859002985091933762133344654",
                "210206041985135136950194436965688247356",
                "273017952127347794324505716363446942479",
                "215266764948728349345054423260840884936",
                "113882731778806143570271993420664461910",
                "202088886572729497275151883012592953971",
                "324793392085535010887681869765726046041",
                "42658774117124304450211575470083134644",
                "50262157903535875620392073508870548556",
                "120040666033482319687722945652601240303",
                "260799055709239268700954339116924631965",
                "323901172699614103124743595180263249878",
                "85975408953531156242993437533387545950",
                "178656476791359191101755885732862180810",
                "73970344064062858403178182810141793371"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-49794-8e402e54",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@97fea18b7138caf76bf17d003f4985d8797d26f9",
        "target":  {
            "file":  "parser.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "188868355829031609633788262857212121916",
            "length":  373
        },
        "id":  "CVE-2025-49794-af0d6027",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@97fea18b7138caf76bf17d003f4985d8797d26f9",
        "target":  {
            "file":  "parser.c",
            "function":  "xmlFreeParserCtxt"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "63821185044893372496077545820715775803",
            "length":  1189
        },
        "id":  "CVE-2025-49794-bf1ac1fe",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@97fea18b7138caf76bf17d003f4985d8797d26f9",
        "target":  {
            "file":  "parser.c",
            "function":  "xmlSAXParseDTD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "68140434741011183212570756410483439558",
            "length":  433
        },
        "id":  "CVE-2025-49794-dbee0434",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@97fea18b7138caf76bf17d003f4985d8797d26f9",
        "target":  {
            "file":  "parser.c",
            "function":  "xmlSAXParseMemory"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "131197706378201909763948975028710299148",
            "length":  417
        },
        "id":  "CVE-2025-49794-e6f39574",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/libxml2@97fea18b7138caf76bf17d003f4985d8797d26f9",
        "target":  {
            "file":  "parser.c",
            "function":  "xmlSAXParseFile"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:17:53Z"