CVE-2025-49794

CRITICAL

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

CVSS v3.1 Score

9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH
Published: 6/16/2025Modified: 10/29/2026

Related Intelligence (1)

CRITICALVulnerability

Siemens SINEC OS

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.</strong></p> <p>The following versions of Siemens SINEC OS are affected:

CVE-2025-1352CVE-2025-1376
CISA Advisories

References (34)

https://access.redhat.com/errata/RHSA-2025:10630https://access.redhat.com/errata/RHSA-2025:10698https://access.redhat.com/errata/RHSA-2025:10699https://access.redhat.com/errata/RHSA-2025:11580https://access.redhat.com/errata/RHSA-2025:12098https://access.redhat.com/errata/RHSA-2025:12099https://access.redhat.com/errata/RHSA-2025:12199https://access.redhat.com/errata/RHSA-2025:12237https://access.redhat.com/errata/RHSA-2025:12239https://access.redhat.com/errata/RHSA-2025:12240https://access.redhat.com/errata/RHSA-2025:12241https://access.redhat.com/errata/RHSA-2025:13335https://access.redhat.com/errata/RHSA-2025:15397https://access.redhat.com/errata/RHSA-2025:15827https://access.redhat.com/errata/RHSA-2025:15828https://access.redhat.com/errata/RHSA-2025:18217https://access.redhat.com/errata/RHSA-2025:18218https://access.redhat.com/errata/RHSA-2025:18219https://access.redhat.com/errata/RHSA-2025:18240https://access.redhat.com/errata/RHSA-2025:19020https://access.redhat.com/errata/RHSA-2025:19041https://access.redhat.com/errata/RHSA-2025:19046https://access.redhat.com/errata/RHSA-2025:19894https://access.redhat.com/errata/RHSA-2025:21913https://access.redhat.com/errata/RHSA-2026:0934https://access.redhat.com/errata/RHSA-2026:62549https://access.redhat.com/errata/RHSA-2026:67857https://access.redhat.com/errata/RHSA-2026:7519https://access.redhat.com/security/cve/CVE-2025-49794https://bugzilla.redhat.com/show_bug.cgi?id=2372373https://gitlab.gnome.org/GNOME/libxml2/-/issues/931https://lists.debian.org/debian-lts-announce/2025/07/msg00014.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-253495.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-577017.html