Vulnary
← back to the feed
Critical· 9.1

CVE-2025-49794

A critical flaw in libxml2 can cause a program that uses the library to crash when it processes a specially crafted XML file. The bug is a use‑after‑free that occurs while parsing XPath elements in schematron schemas. It can be triggered remotely without any user interaction.

publishedJun 16, 2025
last modifiedAug 2, 2026
sourcesNVD
severity · cvss
9.1
critical · how bad it is
exploitation · epss
<1%
50th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 2, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

libxml2, the XML parsing library used in many applications and operating systems. The specific vulnerable versions are not listed, so any installation that has not been updated to a patched release may be affected.

02

Real-world impact

An attacker who can supply a malicious XML document to a program that uses libxml2 could cause that program to crash or exhibit undefined behavior, potentially leading to denial of service or, in some cases, arbitrary code execution if the crash can be exploited further.

03

Why this severity

The CVSS score of 9.1 reflects that the vulnerability can be exploited over the network (AV:N), requires no special privileges (PR:N), and does not need user interaction (UI:N). The impact is high for integrity and availability (I:H/A:H), while confidentiality is not affected (C:N). The low attack complexity (AC:L) and universal scope (S:U) make it a critical risk.

04

What to do about it

no official fix yet

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources

05

Timeline

  1. Jun 16, 2025 · Jun 16, 2025
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Aug 2, 2026 · 3d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactNone
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →