# CVE-2025-49794

## Summary

- **CVE ID:** CVE-2025-49794
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- **CWE:** CWE-825
- **Published:** Jun 16, 2025
- **Last Modified:** Sep 10, 2026

## Description

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

## Affected Products

- Unknown product (0)
- Red Hat — Red Hat Enterprise Linux 10 (0:2.12.5-7.el10_0)
- Red Hat — Red Hat Enterprise Linux 7 Extended Lifecycle Support (0:2.9.1-6.el7_9.10)
- Red Hat — Red Hat Enterprise Linux 8 (0:2.9.7-21.el8_10.1)
- Red Hat — Red Hat Enterprise Linux 8.2 Advanced Update Support (0:2.9.7-9.el8_2.3)
- Red Hat — Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (0:2.9.7-9.el8_4.6)
- Red Hat — Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On (0:2.9.7-9.el8_4.6)
- Red Hat — Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (0:2.9.7-13.el8_6.10)
- Red Hat — Red Hat Enterprise Linux 8.6 Telecommunications Update Service (0:2.9.7-13.el8_6.10)
- Red Hat — Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions (0:2.9.7-13.el8_6.10)
- Red Hat — Red Hat Enterprise Linux 8.8 Telecommunications Update Service (0:2.9.7-16.el8_8.9)
- Red Hat — Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (0:2.9.7-16.el8_8.9)
- Red Hat — Red Hat Enterprise Linux 9 (0:2.9.13-10.el9_6)
- Red Hat — Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions (0:2.9.13-1.el9_0.5)
- Red Hat — Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (0:2.9.13-3.el9_2.7)
- Red Hat — Red Hat Enterprise Linux 9.4 Extended Update Support (0:2.9.13-10.el9_4)
- Red Hat — Red Hat OpenShift Container Platform 4.12 (412.86.202510291903-0)
- Red Hat — Red Hat OpenShift Container Platform 4.13 (413.92.202510150118-0)
- Red Hat — Red Hat OpenShift Container Platform 4.14 (414.92.202510211419-0)
- Red Hat — Red Hat OpenShift Container Platform 4.17 (417.94.202510112152-0)
- Red Hat — Red Hat OpenShift Container Platform 4.18 (418.94.202510230424-0)
- Red Hat — Red Hat OpenShift Container Platform 4.19 (4.19.9.6.202510140714-0)
- Red Hat — Red Hat OpenShift Container Platform 4.20 (4.20.9.6.202509251656-0)
- Red Hat — Red Hat Web Terminal 1.11 on RHEL 9 (1.11-19)
- Red Hat — Red Hat Web Terminal 1.11 on RHEL 9 (1.11-8)
- Red Hat — Red Hat Web Terminal 1.12 on RHEL 9 (1.12-4)
- Red Hat — RHOSS-1.36-RHEL-8 (1.36.0-11)
- Red Hat — RHOSS-1.36-RHEL-8 (1.36.0-10)
- Red Hat — RHOSS-1.36-RHEL-8 (1.36.0-4)
- Red Hat — RHOSS-1.36-RHEL-8 (1.36.0-9)
- Red Hat — RHOSS-1.36-RHEL-8 (1.36.0-12)
- Red Hat — RHOSS-1.36-RHEL-8 (1.36.0-18)
- Red Hat — RHOSS-1.36-RHEL-8 (1.36.0-7)
- Red Hat — cert-manager operator for Red Hat OpenShift 1.16 (sha256:1abdfac084e7c86e7a93a19e5cf6b54db79b903bfb7474a42200f753b29eda4b)
- Red Hat — File Integrity Operator 1 (sha256:86d2378dea6c26da92e19e1a8dc9c9fb0fa8587fd60f83e6cc4503153e753db9)
- Red Hat — Red Hat Insights proxy 1.5 (sha256:c26d589f12647890b67aaa986f54d3f7c6f7f2563fb5a73f38d559e6138739d7)
- Red Hat — cert-manager operator for Red Hat OpenShift 1.16 (sha256:df852ad92734bc087e213e6c7075daf6d7010db4ab72919649736804e295a6a2)
- Red Hat — File Integrity Operator 1 (sha256:59fcdf4ea159ba76fdb582011263672646dd9d63304a91592c0a21d0f43986a4)
- Red Hat — Red Hat Insights proxy 1.5 (sha256:e54a5a5f9d69dd6a03e2bcd845e2202910a188d266d4a79b12c387ceffc36f2d)
- Red Hat — File Integrity Operator 1 (sha256:364d11af112a5b1d3f28c9ea8b7aac678e111b9c7fca0516d61036904f318605)
- Red Hat — Red Hat Hardened Images (2.15.2-0.3.hum1)
- Red Hat — cert-manager operator for Red Hat OpenShift 1.16 (v1.16.5-1760515757)
- Red Hat — File Integrity Operator 1 (v1.3)
- Red Hat — Red Hat Insights proxy 1.5 (1.5.5-1754504343)
- Red Hat — OpenShift File Integrity Operator - FIO 1 (v1.3)
- Red Hat — Compliance Operator 1 (v1.3)
- Red Hat — Red Hat OpenShift Container Platform 4.16 (416.94.202609011112-0)

## References

- [CNA](https://access.redhat.com/errata/RHSA-2025:10630)
- [CNA](https://access.redhat.com/errata/RHSA-2025:10698)
- [CNA](https://access.redhat.com/errata/RHSA-2025:10699)
- [CNA](https://access.redhat.com/errata/RHSA-2025:11580)
- [CNA](https://access.redhat.com/errata/RHSA-2025:12098)
- [CNA](https://access.redhat.com/errata/RHSA-2025:12099)
- [CNA](https://access.redhat.com/errata/RHSA-2025:12199)
- [CNA](https://access.redhat.com/errata/RHSA-2025:12237)
- [CNA](https://access.redhat.com/errata/RHSA-2025:12239)
- [CNA](https://access.redhat.com/errata/RHSA-2025:12240)
- [CNA](https://access.redhat.com/errata/RHSA-2025:12241)
- [CNA](https://access.redhat.com/errata/RHSA-2025:13335)
- [CNA](https://access.redhat.com/errata/RHSA-2025:15397)
- [CNA](https://access.redhat.com/errata/RHSA-2025:15827)
- [CNA](https://access.redhat.com/errata/RHSA-2025:15828)
- [CNA](https://access.redhat.com/errata/RHSA-2025:18217)
- [CNA](https://access.redhat.com/errata/RHSA-2025:18218)
- [CNA](https://access.redhat.com/errata/RHSA-2025:18219)
- [CNA](https://access.redhat.com/errata/RHSA-2025:18240)
- [CNA](https://access.redhat.com/errata/RHSA-2025:19020)
- [CNA](https://access.redhat.com/errata/RHSA-2025:19041)
- [CNA](https://access.redhat.com/errata/RHSA-2025:19046)
- [CNA](https://access.redhat.com/errata/RHSA-2025:19894)
- [CNA](https://access.redhat.com/errata/RHSA-2025:21913)
- [CNA](https://access.redhat.com/errata/RHSA-2026:0934)
- [CNA](https://access.redhat.com/security/cve/CVE-2025-49794)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2372373)
- [CVE](https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html)
- [CNA](https://gitlab.gnome.org/GNOME/libxml2/-/issues/931)
- [CNA](https://access.redhat.com/errata/RHSA-2026:7519)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-577017.html)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)
- [CNA](https://access.redhat.com/errata/RHSA-2026:62549)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.78%
- **EPSS Percentile:** 53.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._