This vulnerability (CVE-2025-49795) is a NULL pointer dereference in libxml2 during XPath XML expression processing. An attacker can craft malicious XML input that triggers this flaw, resulting in a denial of service by crashing the affected application or system. The issue affects Red Hat Enterprise Linux 10 and related products using libxml2. Red Hat has released security updates that fix this vulnerability alongside other libxml2 issues. The CVSS 3.1 base score is 7.5 (high severity), reflecting network attack vector, no privileges required, no user interaction, and impact limited to availability (denial of service).

Successful exploitation leads to denial of service, causing affected applications or systems to crash or become unavailable. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented. The vulnerability affects multiple Red Hat Enterprise Linux 10 variants and Red Hat JBoss Core Services that bundle libxml2.

Red Hat has released official security updates for libxml2 that address this vulnerability. Users and administrators should apply the updated libxml2 packages as provided in Red Hat Advisory RHSA-2025:10630 and related errata. The vendor advisory confirms the availability of patches and recommends updating affected systems promptly. No additional mitigation steps are indicated beyond applying the official fixes.