Skip to main content

EUVD-2025-18416

| CVE-2025-49795 HIGH
Expired Pointer Dereference (CWE-825)
2025-06-16 secalert@redhat.com
Denial Of Service
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Analysis Updated
Apr 19, 2026 - 20:31 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Apr 19, 2026 - 20:22 vuln.today
cvss_changed
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 14, 2026 - 21:59 euvd
EUVD-2025-18416
Analysis Generated
Mar 14, 2026 - 21:59 vuln.today
PoC Detected
Oct 27, 2025 - 18:15 vuln.today
Public exploit code
CVE Published
Jun 16, 2025 - 16:15 nvd
HIGH 7.5

DescriptionCVE.org

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

AnalysisAI

NULL pointer dereference in libxml2's XPath processing engine crashes applications parsing untrusted XML. Affects all major Linux distributions including Red Hat Enterprise Linux 10, Ubuntu (10 releases), Debian (8 releases), and SUSE. Remote unauthenticated attackers can trigger denial of service by sending crafted XPath expressions embedded in XML documents. Publicly available exploit code exists (GitHub gist). EPSS score is low (0.15%, 36th percentile) indicating limited widespread exploitation observed, and not currently listed in CISA KEV. Vendor patches available from Red Hat (2.12.5-7.el10_0), SUSE, and upstream libxml2 project.

Technical ContextAI

libxml2 is a foundational XML parsing library used extensively across Linux/Unix systems and embedded in countless applications, web servers, programming language runtimes (Python, PHP, Ruby), and system utilities. The vulnerability resides in the XPath expression evaluation engine, which traverses XML document trees using path notation. CWE-825 (expired pointer dereference) indicates the code attempts to access memory through a NULL pointer during XPath processing, likely when handling malformed or edge-case XPath syntax against specific XML structures. Because XPath evaluation is triggered automatically when applications process user-supplied XML containing embedded XPath expressions (common in XSLT transformations, XML queries, and configuration files), the attack surface is broad. The vulnerability affects the core libxml2 library rather than a specific application, meaning exploitation impacts any software statically or dynamically linked against vulnerable libxml2 versions.

RemediationAI

Apply vendor-provided patches immediately for systems processing untrusted XML. Red Hat Enterprise Linux 10 users should upgrade to libxml2 2.12.5-7.el10_0 via RHSA-2025:10630 (https://access.redhat.com/errata/RHSA-2025:10630). Ubuntu and Debian users should apply updates through standard package managers as tracked in their security advisories. SUSE customers should deploy SUSE-SU-2025:02260 or SUSE-SU-2025:02314 depending on version (https://www.suse.com/support/update/SUSE-SU-2025:02260/). For environments where immediate patching is infeasible, implement compensating controls: disable XPath functionality in applications if not required (consult application documentation for flags like --noxpath or configuration settings), restrict XML input sources to trusted origins only via firewall rules or application logic, deploy rate limiting and resource quotas to contain denial-of-service impact, and enable application-level input validation to reject XML documents containing XPath expressions before passing to libxml2. Note that disabling XPath may break legitimate application features like XSLT transformations or XQuery functionality. Service restarts are automatically mitigated by application restart mechanisms, making this lower priority than RCE vulnerabilities, but repeated crashes can constitute effective availability attacks against public-facing services.

Vendor StatusVendor

Ubuntu

Priority: Medium
libxml2
Release Status Version
upstream needs-triage -
trusty not-affected code not present
oracular ignored end of life, was needs-triage
bionic not-affected code not present
focal not-affected code not present
jammy not-affected code not present
noble not-affected code not present
plucky not-affected code not present
xenial not-affected code not present
questing released 2.14.5+dfsg-0.2

Debian

libxml2
Release Status Fixed Version Urgency
bullseye fixed 2.9.10+dfsg-6.7+deb11u4 -
bullseye (security) fixed 2.9.10+dfsg-6.7+deb11u9 -
bookworm fixed 2.9.14+dfsg-1.3~deb12u5 -
bookworm (security) fixed 2.9.14+dfsg-1.3~deb12u4 -
trixie fixed 2.12.7+dfsg+really2.9.14-2.1+deb13u2 -
trixie (security) fixed 2.12.7+dfsg+really2.9.14-2.1+deb13u1 -
forky, sid fixed 2.15.1+dfsg-2 -
(unstable) not-affected - -

SUSE

Severity: High
Product Status
Container bci/kiwi:9.24.43-16.25 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container bci/spack:0.23.1-11.20 Container containers/lmcache-vllm-openai:0.3.2-1.2 Container containers/open-webui:0.6.9-10.36 Container containers/pytorch:2.7.0-nvidia-2.33 Container containers/vllm-openai:0.9.1-1.2 Container private-registry/harbor-db:2.12.2-2.16 Container private-registry/harbor-nginx:1.21.5-2.15 Container suse/manager/5.0/x86_64/proxy-salt-broker:5.0.5.1.7.28.2 Container suse/manager/5.0/x86_64/proxy-squid:5.0.5.1.7.26.1 Container suse/manager/5.0/x86_64/server-migration-14-16:5.0.5.1.7.26.2 Container suse/mariadb:10.11.11-68.18 Container suse/sle-micro/5.5/toolbox:14.2-3.12.59 Container suse/sle-micro/5.5:2.0.4-5.5.329 Container suse/sle-micro/base-5.5:2.0.4-5.8.185 Container suse/sle-micro/kvm-5.5:2.0.4-3.5.354 Container suse/sle-micro/rt-5.5:2.0.4-4.5.430 Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-Aliyun Image SLES15-SP5-CHOST-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-EC2 Image SLES15-SP5-CHOST-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-GDC Image SLES15-SP5-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image ai_15_6 Affected
Container private-registry/harbor-portal:1.1.0-1.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.5.1 Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.0.6.27 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.0.7.32 Container suse/multi-linux-manager/5.1/x86_64/proxy-squid:5.1.0.6.21 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.0.6.27 Container suse/multi-linux-manager/5.1/x86_64/server-postgresql:5.1.2.6.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.2.9.13.1 Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image proxy-httpd-image Image proxy-salt-broker-image Image proxy-squid-image Image server-database-migration-image Image server-image Image server-migration-14-16-image Image server-postgresql-image Image server-saline-image Affected
Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1 Affected
Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1 Affected

Share

EUVD-2025-18416 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy