CVE-2025-49795

Published: Jun 16, 2025Modified: Jul 7, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

Related CWEs

CWE-825

Expired Pointer Dereference

The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

References (7)

https://access.redhat.com/errata/RHSA-2025:10630

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2025:19020

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:7519

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-49795

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2372379

Source: secalert@redhat.com

https://gitlab.gnome.org/GNOME/libxml2/-/issues/932

Source: secalert@redhat.com

https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.