CVE-2025-49796 is a type confusion vulnerability in the libxml2 library that can be triggered by processing specially crafted sch:name elements in XML input. This flaw leads to a denial of service condition by causing libxml2 to crash or exhibit undefined behavior due to memory corruption. The vulnerability affects Red Hat Enterprise Linux versions 8 and 10 across multiple architectures. Red Hat has issued security advisories RHSA-2025:10630 and RHSA-2025:10698 that include updated libxml2 packages addressing this and related vulnerabilities. The CVSS v3.1 base score is 9.1, reflecting critical severity with network attack vector, no privileges or user interaction required, and high impact on integrity and availability. No known exploits in the wild have been reported at this time.

Successful exploitation of CVE-2025-49796 can cause libxml2 to crash, resulting in denial of service or potential memory corruption leading to undefined behavior. The vulnerability does not directly compromise confidentiality but can severely impact system integrity and availability. The CVSS score of 9.1 indicates critical severity. No known active exploitation has been reported. The impact is limited to systems using vulnerable versions of libxml2 on Red Hat Enterprise Linux 8 and 10.

Red Hat has released official security updates for libxml2 that address CVE-2025-49796 along with related vulnerabilities. Users of Red Hat Enterprise Linux 8 and 10 should apply the updated libxml2 packages as detailed in Red Hat advisories RHSA-2025:10630 and RHSA-2025:10698. For update instructions, refer to https://access.redhat.com/articles/11258. Applying these updates mitigates the vulnerability. No additional mitigation is required beyond applying the official patches.