CVE-2025-49794: libxml2 Use-After-Free Vulnerability

CVE-2025-49794 Overview

CVE-2025-49794 is a use-after-free vulnerability in libxml2, the widely deployed XML parsing library maintained by the GNOME project. The flaw occurs when parsing XPath elements under specific conditions involving XML Schematron documents that contain <sch:name path="..."/> schema elements. An attacker can craft a malicious XML document that, when processed by libxml2, triggers memory corruption through access to a freed object [CWE-825]. Successful exploitation results in process crashes or other undefined behavior, including the potential for further memory corruption. Because libxml2 is embedded in countless operating systems, language runtimes, browsers, and industrial control products, the impact surface is broad.

Critical Impact

A remote attacker can trigger a use-after-free in libxml2 by supplying a crafted XML document to any application that parses untrusted XML with Schematron schema processing enabled.

Affected Products

• GNOME libxml2 (see GNOME libxml2 Issue #931)
• Red Hat Enterprise Linux distributions shipping libxml2 (see Red Hat CVE Report CVE-2025-49794)
• Debian LTS libxml2 packages (see Debian LTS Announcement July 2025)
• Siemens industrial products bundling libxml2 (see Siemens Product Security SSA-577017)

Discovery Timeline

• 2025-06-16 - CVE-2025-49794 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-49794

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-825] in the XPath evaluation path of libxml2. It is reachable when the library processes a Schematron schema containing <sch:name path="..."/> elements. During XPath compilation and evaluation tied to these Schematron constructs, libxml2 references a memory object after it has been released back to the allocator. Subsequent operations on the dangling pointer corrupt internal parser state.

The consequences are determined by allocator behavior at the time of the freed-object reuse. In the most common case, the process aborts due to invalid memory access, producing a denial-of-service condition for the host application. Under attacker-controlled heap layouts, the dangling reference may operate on attacker-influenced data, leading to undefined behavior that affects integrity as well as availability. The vulnerability requires no authentication and no user interaction beyond submitting an XML document to a vulnerable parser.

Root Cause

The defect lies in the lifetime management of XPath context objects created while evaluating Schematron path attributes. An internal reference is retained after the underlying allocation is freed, causing later code paths to dereference an invalid pointer.

Attack Vector

An attacker delivers a malicious XML document to any application that links against vulnerable libxml2 and performs Schematron validation. Delivery channels include web service endpoints that accept XML payloads, document-processing pipelines, configuration parsers in network appliances, and industrial control protocols. The attacker requires no privileges on the target.

No verified public exploit code is available. The technical mechanism is described in GNOME libxml2 Issue #931 and the Red Hat Bugzilla Report #2372373.

Detection Methods for CVE-2025-49794

Indicators of Compromise

• Unexpected crashes, SIGSEGV signals, or core dumps from processes that invoke libxml2, particularly during XML or Schematron validation workloads.
• Inbound XML payloads containing <sch:name path="..."/> elements directed at services not normally consuming Schematron schemas.
• Repeated parser failures or restart loops in applications such as web servers, document processors, or industrial gateways that embed libxml2.

Detection Strategies

• Inventory installed libxml2 versions across Linux, macOS, and Windows hosts and compare them against the fixed packages listed in the Red Hat and Debian advisories.
• Inspect network traffic and message queues for XML documents that include Schematron namespaces (http://purl.oclc.org/dsdl/schematron) sent to services that do not require them.
• Correlate application crash telemetry with XML parsing activity to surface exploitation attempts producing denial of service.

Monitoring Recommendations

• Forward application crash events, systemd-coredump records, and Windows Error Reporting logs to a centralized analytics platform for correlation with XML processing.
• Enable verbose logging on XML-consuming services to capture document metadata and source identifiers for post-incident review.
• Track package update status for libxml2 across all managed hosts and alert on hosts that remain on pre-patch versions.

How to Mitigate CVE-2025-49794

Immediate Actions Required

• Apply the libxml2 updates published by your operating system vendor. Red Hat customers should consult the relevant advisory for their channel, beginning with RHSA-2025:10630.
• Restart all long-running services that load libxml2 so the patched library is loaded into memory.
• Audit applications that accept untrusted XML and disable Schematron processing where it is not required.

Patch Information

Fixed libxml2 packages are available through upstream GNOME and downstream distributions. Red Hat has published more than 25 advisories covering affected products, including RHSA-2025:10630, RHSA-2025:11580, RHSA-2025:13335, and RHSA-2026:7519. Debian LTS users should follow the Debian LTS Announcement July 2025. Industrial operators running Siemens products must apply the firmware and software updates referenced in Siemens SSA-577017.

Workarounds

• Reject XML documents containing Schematron schema elements at network or application boundaries when Schematron is not a required feature.
• Sandbox XML parsing processes with seccomp, AppArmor, or SELinux profiles to limit the impact of a successful crash or memory corruption.
• Validate and constrain XML input size, depth, and accepted namespaces before passing documents to libxml2.

# Configuration example: verify installed libxml2 version on RHEL-family systems
rpm -q libxml2

# Apply vendor updates and restart services that link libxml2
sudo dnf update -y libxml2
sudo systemctl restart httpd php-fpm