CVE-2025-49795 is a NULL pointer dereference vulnerability in the libxml2 library used by GNOME, triggered during XPath XML expression processing. An attacker can exploit this by supplying malicious XML input, causing the library to dereference a NULL pointer and crash, resulting in a denial of service. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. Red Hat advisories confirm the issue and provide patched libxml2 packages for Red Hat Enterprise Linux 10 and related products. The patches address this and related libxml2 vulnerabilities, mitigating the denial of service risk.

Successful exploitation of this vulnerability results in a denial of service condition due to a NULL pointer dereference in libxml2 when processing crafted XML input. This can cause affected applications or services relying on libxml2 to crash or become unavailable. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented at this time.

Red Hat has released official security updates that fix this vulnerability in libxml2 for Red Hat Enterprise Linux 10 and related products. Users should apply these updates as soon as possible to remediate the issue. The vendor advisory provides detailed instructions and download links for the patched packages. No additional mitigation is required once the update is applied.