CVE-2025-49796 PUBLISHED

Libxml: type confusion leads to denial of service (dos)

Assigner: redhat
Reserved: 10.06.2025 Published: 16.06.2025 Updated: 16.06.2025

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 9.1

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unknown
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat JBoss Core Services
Versions Default: affected

Workarounds

There's no available mitigation other than to avoid processing untrusted XML documents before updating to the libxml version containing the fix.

References

Problem Types

  • Out-of-bounds Read CWE