CVE-2025-49794 is a use-after-free vulnerability in libxml2 triggered during parsing of XPath elements under specific conditions involving XML schematron <sch:name path="..."/> elements. This memory management flaw can lead to program crashes or other undefined behaviors when processing maliciously crafted XML input. The vulnerability has been assigned a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating it is remotely exploitable without privileges or user interaction, causing high impact on integrity and availability. Red Hat has issued multiple security advisories with patches for affected versions of libxml2 and related products, including Red Hat Enterprise Linux and OpenShift Container Platform. No public exploit code or active exploitation has been reported to date.

The vulnerability allows remote attackers to cause denial of service (program crash) or potentially other undefined behaviors by supplying crafted XML documents to libxml2. The impact affects integrity and availability but not confidentiality. The CVSS score of 9.1 reflects critical severity due to remote exploitability without authentication or user interaction. No known exploits in the wild have been reported, but the flaw poses a significant risk if exploited.

Official patches are available from Red Hat as detailed in multiple security advisories (e.g., RHSA-2025:18219, RHSA-2025:18240). Users should apply these updates promptly to affected products, including Red Hat Enterprise Linux and OpenShift Container Platform. For OpenShift, upgrade instructions are provided by Red Hat and should be followed to fully apply the fixes. No additional mitigation steps are required beyond applying these official updates. There are no indications that this vulnerability is mitigated by default or requires no action.