CVE-2025-49794
CWE-825Published: June 16, 2025· Updated: Jun 29, 2026
Official Description
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
Risk Analysis
A use-after-free vulnerability in libxml2 occurs during the parsing of specific XPath elements, potentially leading to application crashes or undefined behavior. This critical flaw can be triggered by a remote attacker providing a malicious XML document. The 9.1 CVSS score emphasizes the risk to system stability.
No public exploit is known, and it is not in the KEV. The vulnerability is remotely exploitable with low attack complexity.
Update libxml2 to the latest version. Ensure that all XML processing is performed using hardened configurations and updated libraries.
Technical Analysis
CVE-2025-49794 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.1.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
News & Research Mentioning CVE-2025-49794
View CSAF Summary SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/ cork. syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5. Send data less than cork_bytes At 5., the data is carried over to the next sendmsg() as it is smaller than the cork_bytes specified by bpf_msg_cork_bytes(). Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold the data, but t [xlite_meta score:73 src:CISA Alerts xlite_fp:c21152d4d475a8e030213da473dfe64f022ad052db21f63751c61a376d2d7ec4]
View CSAF Summary Ruggedcom Rox before v2.17.1 contain multiple third-party vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens Ruggedcom Rox are affected: RUGGEDCOM ROX MX5000 vers:intdot/ data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. View CVE Details Affected Products Siemens Ruggedcom Rox Vendor: Siemens Product Version: RUGGEDCOM ROX MX5000, RUGGEDCOM ROX MX5000RE, RUGGEDCOM ROX RX1400, RUGGEDCOM ROX RX1500, RUGGEDCOM ROX RX1501, RUGGEDCOM ROX RX1510, RUGGEDCOM ROX RX151 [xlite_meta score:73 src:CISA Alerts xlite_fp:fa557619a1cae77298fa5e157cc629cc9faaa87a2fc16e1a5bed6e01d4d89758]
All References (32)
Quick Facts
Related CVEs (CWE-825)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-49794 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts