Red Hat Product Security has released a bug fix advisory RHBA-2025:6597 for libxml2 in Red Hat Enterprise Linux 10. This advisory addresses three CVEs: CVE-2024-40896, CVE-2024-56171, and CVE-2025-24928, which correspond to vulnerabilities involving XML external entity injection, use-after-free, and stack-based buffer overflow issues. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 10, including Extended Update Support and CodeReady Linux Builder editions. Detailed changes are documented in the Red Hat Enterprise Linux 10 Release Notes. The advisory does not provide a CVSS score but classifies the severity as critical. No known exploits in the wild have been reported at this time.

The vulnerabilities fixed in this advisory could allow an attacker to cause memory corruption or execute arbitrary code due to issues such as use-after-free and buffer overflow, or to exploit XML external entity injection flaws. These issues pose a critical risk to affected systems running vulnerable versions of libxml2 on Red Hat Enterprise Linux 10. However, there are no reports of active exploitation in the wild currently.

Red Hat has released updated libxml2 packages for Red Hat Enterprise Linux 10 and its variants. Users should apply these official updates as described in the Red Hat advisory RHBA-2025:6597 and the linked Red Hat Enterprise Linux 10 Release Notes. The vendor provides detailed instructions for applying the update at https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor.