Description
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
References10
- access.redhat.com/errata/RHSA-2025:10630
- access.redhat.com/errata/RHSA-2025:10698
- access.redhat.com/errata/RHSA-2025:10699
- access.redhat.com/errata/RHSA-2025:11580
- access.redhat.com/errata/RHSA-2025:12098
- access.redhat.com/errata/RHSA-2025:12099
- access.redhat.com/errata/RHSA-2025:12199
- access.redhat.com/errata/RHSA-2025:12237
- access.redhat.com/errata/RHSA-2025:12239
- access.redhat.com/errata/RHSA-2025:12240
Metrics
- CVSS 3.1
-
9.1
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - EPSS — exploit probability
- 1% percentile: 58 · as of 7 November 2026
- CWE
- CWE-825
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.