CVE-2025-49794 is a heap use-after-free vulnerability in libxml2 triggered during parsing of XPath elements when XML schematron <sch:name path="..."/> schema elements are present. This flaw allows a crafted malicious XML document to cause a denial of service by crashing the program or causing undefined behavior. Red Hat advisories RHSA-2025:10630 and RHSA-2025:10698 address this issue by providing updated libxml2 packages for Red Hat Enterprise Linux 8 and 10. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating network exploitable with no privileges required, no user interaction, and high impact on integrity and availability.

The vulnerability allows remote attackers to cause denial of service by crashing applications that use libxml2 to parse specially crafted XML documents containing certain XPath elements. There is no confidentiality impact, but integrity and availability are highly impacted due to potential heap use-after-free leading to crashes or undefined behavior. No known exploits in the wild have been reported at this time.

Official patches are available from Red Hat for affected versions of libxml2 in Red Hat Enterprise Linux 8 and 10. Users should apply the updates as described in Red Hat advisories RHSA-2025:10630 and RHSA-2025:10698. The vendor has rated this update as Important and provides detailed instructions for applying the fixes. No additional mitigation steps are required beyond applying the official patches.