A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
The vulnerability (CWE-825) consists of accessing a memory area that has already been freed during processing of XPath elements as part of XML schematron validation. An attacker can craft a specially constructed XML document that, when provided as input to an application using libxml2, will trigger a memory management error. This results in use-after-free, leading to process failure or undefined behavior.
An attacker can cause a crash of an application using libxml2, leading to denial of service (DoS). The CVSS vector also indicates the possibility of compromising system integrity and availability; undefined memory behavior may potentially result in further consequences depending on the application context.
Patches available from the vendor should be applied according to references — for Red Hat systems, updates are available in errata RHSA-2025:10630, RHSA-2025:10698, RHSA-2025:10699, RHSA-2025:11580, and RHSA-2025:12098. It is recommended to update the libxml2 library as soon as possible in all production environments processing external XML documents.
The libxml2 library — specific versions indicated in vendor references (Red Hat errata RHSA-2025:10630, RHSA-2025:10698, RHSA-2025:10699, RHSA-2025:11580, RHSA-2025:12098). Affects systems and applications processing XML documents using libxml2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H