CVE-2025-49795

Exploitation requires the target application to invoke libxml2's XPath evaluation functions on attacker-controlled XML input. Specifically affects applications using xmlXPathEval(), xmlXPathEvalExpression(), or related XPath API calls when processing external XML documents. Not all libxml2 usage is vulnerable - applications that only parse XML structure without evaluating embedded XPath expressions are not affected. Common vulnerable scenarios include XSLT processors, XML database queries, configuration systems accepting XML with XPath selectors, SOAP web services, and document transformation pipelines. Default libxml2 installations are vulnerable when XPath features are used. Exploitation is remote unauthenticated (AV:N/PR:N) when vulnerable applications expose XML processing to network interfaces without authentication. Attack complexity is low (AC:L) requiring only ability to submit crafted XML. No user interaction required (UI:N) for server-side XML processors. Limiting factors: Many libxml2 deployments parse only trusted local configuration files rather than network-supplied XML, significantly reducing real-world attack surface. Applications must specifically invoke XPath evaluation, not merely use libxml2 for basic XML parsing.

Real-world risk is moderate despite high CVSS 7.5 score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates easy remote exploitation without authentication, which normally signals critical priority. However, multiple factors reduce practical urgency: (1) Impact is purely availability (A:H, C:N, I:N) - denial of service crashes the parsing application but provides no code execution, data access, or persistence. (2) EPSS score of 0.15% (36th percentile) is notably low, suggesting attackers are not actively exploiting this vulnerability at scale despite public POC availability. (3) Absence from CISA KEV confirms no widespread or targeted exploitation campaigns detected. (4) Exploitation requires the victim application to process attacker-controlled XML containing XPath expressions, which limits attack vectors to applications accepting external XML input. Many libxml2 users parse trusted configuration files only. The disconnect between high CVSS and low EPSS reflects that while exploitation is technically trivial, the denial-of-service-only impact and requirement for XML processing context make this less attractive than RCE vulnerabilities. Priority depends heavily on whether your libxml2-using applications parse untrusted XML from network sources (web services, document processors) versus only local trusted files (configuration parsers).

Attacker identifies a web application that accepts XML uploads for processing (document conversion service, API endpoint accepting XML requests, SOAP web service). Attacker crafts malicious XML document embedding specially-formed XPath expression designed to trigger NULL pointer dereference during evaluation. POC exploit code publicly available at https://gist.github.com/martinpitt/1824f4a9b0a29ff0c2fb3b1e2f3ddfa0 demonstrates precise payload structure. Attacker submits crafted XML via HTTP POST, causing immediate crash of worker process handling the request. Repeated submissions create persistent denial of service, exhausting application resources through crash-restart loops.