Description
A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected products
- GNOME / libxml22.10.0 – 2.14.5
References
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:10630
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2025:19020
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2026:7519
- VENDOR_ADVISORYhttps://access.redhat.com/security/cve/CVE-2025-49795
- MISChttps://bugzilla.redhat.com/show_bug.cgi?id=2372379
- MISChttps://gitlab.gnome.org/GNOME/libxml2/-/issues/932
Updated 28m ago · 8 sources