CVE-2025-49796 is a type confusion vulnerability in libxml2 that can be triggered by processing specially crafted sch:name elements in XML files. This leads to memory corruption that causes libxml2 to crash, resulting in denial of service or potentially other undefined behaviors due to corrupted memory. The vulnerability affects libxml2 versions starting from 2.9.7 up to but not including 2.12.5, as well as version 0. Red Hat has released security updates addressing this issue in Red Hat Enterprise Linux 8 and 10, among other products. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H). No active exploitation has been observed.

Successful exploitation of this vulnerability results in denial of service due to application crashes caused by memory corruption. The integrity of memory can also be compromised, potentially leading to undefined behavior. Confidentiality is not impacted. The vulnerability does not require privileges or user interaction to exploit and can be triggered remotely via crafted XML input.

Official patches are available from Red Hat for affected libxml2 versions. Users should apply the security updates provided in Red Hat advisories RHSA-2025:10630 and RHSA-2025:10698 for Red Hat Enterprise Linux 10 and 8 respectively. These updates address CVE-2025-49796 along with related libxml2 vulnerabilities. Applying these vendor-provided fixes is the recommended remediation. There is no indication that the issue is already mitigated or requires no action.