This advisory from Red Hat Product Security addresses multiple vulnerabilities in the libxml2 library used in Red Hat Enterprise Linux 10. The vulnerabilities include XML external entity (XXE) issues (CWE-611), use-after-free conditions (CWE-416), and stack-based buffer overflows (CWE-121). The advisory references three CVEs: CVE-2024-40896, CVE-2024-56171, and CVE-2025-24928. The update is delivered as a bug fix and enhancement update to libxml2 packages across multiple architectures and product variants of Red Hat Enterprise Linux 10. The vendor advisory points users to the Red Hat Enterprise Linux 10 Release Notes for detailed information on changes and provides instructions for applying the update. No explicit CVSS scores are provided, and no exploits are currently known in the wild.

The vulnerabilities addressed involve critical memory safety and XML parsing issues that could potentially lead to denial of service or arbitrary code execution if exploited. The presence of CWE-611 indicates risks related to XML external entity processing, which can lead to information disclosure or server-side request forgery. CWE-416 and CWE-121 indicate memory corruption vulnerabilities that could be exploited to execute arbitrary code or crash affected systems. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated libxml2 packages as part of Red Hat Enterprise Linux 10 updates to fix these vulnerabilities. Users should apply the official updates as described in the Red Hat advisory RHBA-2025:6597 and the linked Red Hat Enterprise Linux 10 Release Notes. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates will mitigate the vulnerabilities. There is no indication that additional mitigations are required beyond applying the vendor-provided patches.