CVE-2025-49794criticalCWE-825

CVE-2025-49794: fallo crítico en libxml2

Libxml: heap use after free (uaf) leads to denial of service (dos)

Publicada el 16 jun 2025 · Actualizada el 04 nov 2026

Seguir esta CVE + Monitorear Red Hat Enterprise Linux + Monitorear Red Hat OpenShift Container Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.1epss 0.8%

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Productos afectados

CVEs relacionadas — libxml2

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2025-6021HIGHLibxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2EPSS 1.4%CVE-2025-5914HIGHLibarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.cEPSS 0.5%CVE-2025-6020HIGHLinux-pam: linux-pam directory traversalEPSS 0.5%CVE-2025-7425HIGHLibxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptrEPSS 0.4%CVE-2025-6170LOWLibxml2: stack buffer overflow in xmllint interactive shell command handlingEPSS 0.3%

Referencias