CVE-2025-49794criticalCWE-825

CVE-2025-49794: falha crítica em libxml2

Libxml: heap use after free (uaf) leads to denial of service (dos)

Publicada em 16 jun 2025 · Atualizada em 29 out 2026

Seguir esta CVE + Monitorar Red Hat Enterprise Linux + Monitorar Red Hat OpenShift Container Platform

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.8%

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Produtos afetados

CVEs relacionadas — libxml2

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49796CRITICALLibxml: type confusion leads to denial of service (dos)EPSS 1.6%CVE-2025-6021HIGHLibxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2EPSS 1.4%CVE-2025-5914HIGHLibarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.cEPSS 0.5%CVE-2025-6020HIGHLinux-pam: linux-pam directory traversalEPSS 0.5%CVE-2025-7425HIGHLibxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptrEPSS 0.4%CVE-2025-6170LOWLibxml2: stack buffer overflow in xmllint interactive shell command handlingEPSS 0.3%

Referências