Skip to main content

Expired Pointer Dereference in bitwiseworks:libxml2-os2

CVE-2025-49794

  • bitwiseworks:libxml2-os2
  • gerph:libxml2
  • jupitex:node-libxml
  • libxml2
  • libxml
  • libxmljs
  • libxml2-nodejs
  • libxml2-python3
  • OpenCMISS-Dependencies:libxml2
High
9.1/10

Summary

A Use-After-Free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the "<sch:name path="..."/>" schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors. The issue affects libxml and libxml2 versions v2.7.3 and after, LIBXML2_2_6_21 and after, LIBXML2.6.31 and after. This CVE shares the same fix as CVE-2025-49796.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-825 - Expired Pointer Dereference

The program dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

References

Advisory Timeline

  • Published