CVE-2025-49794 is a heap use-after-free vulnerability in the libxml2 library triggered during parsing of XPath elements under specific conditions involving XML schematron <sch:name path="..."/> elements. This vulnerability allows an attacker to craft malicious XML input that causes the affected program to crash or behave unpredictably. The issue is rated critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating network exploitable with low attack complexity, no privileges or user interaction required, and impacts integrity and availability. Red Hat advisories RHSA-2025:10630 and RHSA-2025:10698 provide patches and updates for affected Red Hat Enterprise Linux 8 and 10 versions. The advisories confirm the vulnerability leads to denial of service via heap use-after-free and that fixes are available.

The vulnerability can cause denial of service by crashing applications that use libxml2 to parse specially crafted XML documents containing certain XPath schematron elements. It impacts integrity and availability but does not affect confidentiality. There are no known exploits in the wild at this time. The CVSS score of 9.1 reflects critical severity due to remote exploitability without authentication and potential for service disruption.

Red Hat has released official patches for libxml2 addressing CVE-2025-49794 in Red Hat Enterprise Linux versions 8 and 10. Users should apply the updated libxml2 packages as provided in Red Hat advisories RHSA-2025:10630 and RHSA-2025:10698. Applying these updates mitigates the vulnerability. No additional mitigations are specified or required beyond applying the vendor's official fixes.