CVE-2025-49794

EUVD-2025-18412
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 63%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
SiemensRUGGEDCOM ROX MX5000
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX MX5000RE
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1400
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1500
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1501
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1510
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1511
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1512
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1524
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX1536
𝑥
< V2.17.1
ADP
SiemensRUGGEDCOM ROX RX5000
𝑥
< V2.17.1
ADP
Debian logo
Debian Releases
Debian Product
Codename
libxml2
bookworm
2.9.14+dfsg-1.3~deb12u5
fixed
bookworm (security)
2.9.14+dfsg-1.3~deb12u4
fixed
bullseye
vulnerable
bullseye (security)
2.9.10+dfsg-6.7+deb11u9
fixed
forky
2.15.2+dfsg-0.1
fixed
sid
2.15.2+dfsg-0.1
fixed
trixie
2.12.7+dfsg+really2.9.14-2.1+deb13u2
fixed
trixie (security)
2.12.7+dfsg+really2.9.14-2.1+deb13u1
fixed
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libxml2-2
suse enterprise desktop 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise server 12 SP3
2.9.4-46.87.1
fixed
suse enterprise server 12 SP5
2.9.4-46.87.1
fixed
suse enterprise server 15 SP2
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP3
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP4
2.9.14-150400.5.44.1
fixed
suse enterprise server 15 SP5
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.4.3.1
fixed
libxml2-2-32bit
suse enterprise desktop 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise server 12 SP3
2.9.4-46.87.1
fixed
suse enterprise server 12 SP5
2.9.4-46.87.1
fixed
suse enterprise server 15 SP2
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP3
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP4
2.9.14-150400.5.44.1
fixed
suse enterprise server 15 SP5
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.4.3.1
fixed
libxml2-devel
suse enterprise desktop 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise server 12 SP5
2.9.4-46.87.1
fixed
suse enterprise server 15 SP2
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP3
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP4
2.9.14-150400.5.44.1
fixed
suse enterprise server 15 SP5
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.4.3.1
fixed
libxml2-doc
suse enterprise server 12 SP3
2.9.4-46.87.1
fixed
suse enterprise server 12 SP5
2.9.4-46.87.1
fixed
libxml2-tools
suse enterprise desktop 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise server 12 SP3
2.9.4-46.87.1
fixed
suse enterprise server 12 SP5
2.9.4-46.87.1
fixed
suse enterprise server 15 SP2
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP3
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP4
2.9.14-150400.5.44.1
fixed
suse enterprise server 15 SP5
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.4.3.1
fixed
python-libxml2
suse enterprise server 12 SP3
2.9.4-46.87.1
fixed
suse enterprise server 12 SP5
2.9.4-46.87.1
fixed
python2-libxml2-python
suse enterprise server 15 SP2
2.9.7-150000.3.82.1
fixed
python3-libxml2
suse enterprise desktop 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise desktop 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise sap 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise sap 15 SP7
2.12.10-150700.4.3.1
fixed
suse enterprise server 15 SP4
2.9.14-150400.5.44.1
fixed
suse enterprise server 15 SP5
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP6
2.10.3-150500.5.29.1
fixed
suse enterprise server 15 SP7
2.12.10-150700.4.3.1
fixed
python3-libxml2-python
suse enterprise server 15 SP2
2.9.7-150000.3.82.1
fixed
suse enterprise server 15 SP3
2.9.7-150000.3.82.1
fixed
python311-libxml2
suse enterprise server 15 SP4
2.9.14-150400.5.44.1
fixed
suse enterprise server 15 SP5
2.10.3-150500.5.29.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
libxml2
RHEL 8
0:2.9.7-21.el8_10.1
fixed
RHEL 8.2 AUS
0:2.9.7-9.el8_2.3
fixed
RHEL 8.4 AUS
0:2.9.7-9.el8_4.6
fixed
RHEL 8.6 AUS
0:2.9.7-13.el8_6.10
fixed
RHEL 8.6 E4S
0:2.9.7-13.el8_6.10
fixed
RHEL 8.6 TUS
0:2.9.7-13.el8_6.10
fixed
RHEL 8.8 E4S
0:2.9.7-16.el8_8.9
fixed
RHEL 8.8 TUS
0:2.9.7-16.el8_8.9
fixed
RHEL 9
0:2.9.13-10.el9_6
fixed
libxml2-devel
RHEL 8
0:2.9.7-21.el8_10.1
fixed
RHEL 8.2 AUS
0:2.9.7-9.el8_2.3
fixed
RHEL 8.4 AUS
0:2.9.7-9.el8_4.6
fixed
RHEL 8.6 AUS
0:2.9.7-13.el8_6.10
fixed
RHEL 8.6 E4S
0:2.9.7-13.el8_6.10
fixed
RHEL 8.6 TUS
0:2.9.7-13.el8_6.10
fixed
RHEL 8.8 E4S
0:2.9.7-16.el8_8.9
fixed
RHEL 8.8 TUS
0:2.9.7-16.el8_8.9
fixed
RHEL 9
0:2.9.13-10.el9_6
fixed
python3-libxml2
RHEL 8
0:2.9.7-21.el8_10.1
fixed
RHEL 8.2 AUS
0:2.9.7-9.el8_2.3
fixed
RHEL 8.4 AUS
0:2.9.7-9.el8_4.6
fixed
RHEL 8.6 AUS
0:2.9.7-13.el8_6.10
fixed
RHEL 8.6 E4S
0:2.9.7-13.el8_6.10
fixed
RHEL 8.6 TUS
0:2.9.7-13.el8_6.10
fixed
RHEL 8.8 E4S
0:2.9.7-16.el8_8.9
fixed
RHEL 8.8 TUS
0:2.9.7-16.el8_8.9
fixed
RHEL 9
0:2.9.13-10.el9_6
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2025:10630
https://access.redhat.com/errata/RHSA-2025:10698
https://access.redhat.com/errata/RHSA-2025:10699
https://access.redhat.com/errata/RHSA-2025:11580
https://access.redhat.com/errata/RHSA-2025:12098
https://access.redhat.com/errata/RHSA-2025:12099
https://access.redhat.com/errata/RHSA-2025:12199
https://access.redhat.com/errata/RHSA-2025:12237
https://access.redhat.com/errata/RHSA-2025:12239
https://access.redhat.com/errata/RHSA-2025:12240
https://access.redhat.com/errata/RHSA-2025:12241
https://access.redhat.com/errata/RHSA-2025:13335
https://access.redhat.com/errata/RHSA-2025:15397
https://access.redhat.com/errata/RHSA-2025:15827
https://access.redhat.com/errata/RHSA-2025:15828
https://access.redhat.com/errata/RHSA-2025:18217
https://access.redhat.com/errata/RHSA-2025:18218
https://access.redhat.com/errata/RHSA-2025:18219
https://access.redhat.com/errata/RHSA-2025:18240
https://access.redhat.com/errata/RHSA-2025:19020
https://access.redhat.com/errata/RHSA-2025:19041
https://access.redhat.com/errata/RHSA-2025:19046
https://access.redhat.com/errata/RHSA-2025:19894
https://access.redhat.com/errata/RHSA-2025:21913
https://access.redhat.com/errata/RHSA-2026:0934
https://access.redhat.com/errata/RHSA-2026:7519
https://access.redhat.com/security/cve/CVE-2025-49794
https://bugzilla.redhat.com/show_bug.cgi?id=2372373
https://gitlab.gnome.org/GNOME/libxml2/-/issues/931
https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html
https://cert-portal.siemens.com/productcert/html/ssa-577017.html