libxml2 0-day Vulnerabilities: CVE-2025-49794 and CVE-2025-49796 Explained

Forum topic · QianXun · 2025-10-13

Summary

libxml2, the widely used open-source XML parsing library found in Linux distributions, containers, and applications, has been affected by two high-severity 0-day vulnerabilities: CVE-2025-49794 and CVE-2025-49796, both type confusion flaws in the Schematron validation module with CVSS scores of 9.1. Disclosed around June 2025 before upstream patches were fully available, both flaws can be triggered remotely via crafted XML documents, causing denial of service or potentially code execution. Affected versions include 2.12.x before 2.12.10 and 2.13.x before 2.13.6. Related issues include CVE-2025-24928, a stack buffer overflow in xmlSnprintfElements requiring DTD validation, and an SGML catalog file overload denial-of-service condition. Attack chains combining XXE with type confusion could enable data leakage. Mitigations include upgrading to libxml2 2.12.10+ or 2.13.6+, disabling Schematron/DTD validation, deploying WAF filtering, and monitoring dependencies via SBOM tooling. This post summarizes vulnerability details, affected systems, exploitation trends, and practical recommendations for defenders.

Overview

libxml2 is a ubiquitous open-source XML parsing library embedded in Linux distributions (Ubuntu, Red Hat), containers (e.g., Kafka in Docker), and applications (PHP, Python XML processing). The first half of 2025 saw a spike in libxml2 0-day disclosures, driven mainly by flaws in the Schematron module and memory management issues. Recent discussion (June–October 2025) centers on CVE-2025-49794 and CVE-2025-49796, which remain actively discussed and may be exploited in the wild. The overall trend shows a shift from denial-of-service toward remote code execution, with rising supply chain attack risk.

Key 0-day Vulnerabilities

CVE-2025-49794: Memory Corruption (CVSS 9.1, High)

Description: Type confusion during Schematron validation causes invalid memory access. An attacker can trigger it with a crafted XML document to bypass validation logic. Affected versions: 2.12.x < 2.12.10 and 2.13.x < 2.13.6.
0-day nature: Disclosed before the PoC was made public on June 3, 2025, but the upstream patch lagged (CVE assigned June 11). Seal Security provided interim "sealed" patches, confirming its zero-day status.
Analysis: The type confusion can be combined with XXE (XML External Entity) to form an out-of-bounds read/write chain.

CVE-2025-49796: Type Confusion (CVSS 9.1, High)

Description: In the Schematron module, validation result types are not properly checked, leading to access of uninitialized attributes. A remote attacker without authentication can cause DoS or code execution via malicious XML. A PoC was published in GitLab Issue #933.
0-day nature: No official patch existed at disclosure; Red Hat rated it 9.1, highlighting exploitation potential in containerized environments (e.g., Kafka).
Exploitation path: Testing combined with DTD validation achieved 100% CPU exhaustion or heap overflow.

Other Recent Related Vulnerabilities

CVE-2025-24928: Stack buffer overflow in xmlSnprintfElements (valid.c), triggered via DTD validation; can be chained into RCE.
SGML Catalog File overload (Vigilance advisory, 2025-10-11): No CVE assigned, but causes DoS; discussion suggests it may be an emerging 0-day.

No brand-new 0-days surfaced in October, but libxml2 maintainers have abandoned the "embargo" policy, increasing public zero-day exposure.

Impact and Exploitation

Affected systems: Ubuntu (USN-7302-1 and other patches), AIX, Power HMC, Docker images (Postgres and others linking libxml2).
In the wild: Seal Security reported PoC scanning activity in Kafka containers. Potential chained attack: XXE + type confusion → data leakage (e.g., /etc/passwd).
Statistics: CVE Details lists 146+ CVEs for libxml2, with 2025 accounting for ~15%, mostly memory-related.

| Vulnerability | CVSS | Type | Affected Versions | Patch Status | |---------|------|------|----------|----------| | CVE-2025-49794 | 9.1 | Type confusion | <2.12.10 / <2.13.6 | Available (upstream 2.12.10+) | | CVE-2025-49796 | 9.1 | Type confusion | <2.12.10 / <2.13.6 | Available (Seal interim patch) | | CVE-2025-24928 | 7.5 | Stack overflow | <2.12.10 / <2.13.6 | Available (IBM AIX patch) |

Mitigation Recommendations

Immediate action: Upgrade to libxml2 2.12.10+ or 2.13.6+. Ubuntu users: apt update && apt upgrade libxml2.
Temporary protection: Disable Schematron/DTD validation (set LIBXML_NO_VALID when using xmlReaderForFile); use a WAF (e.g., ModSecurity) to filter malicious XML.
Version scanner: The original post includes a Lua script (using LuaXML or FFI bindings) to check the local libxml2 version and flag exposure to CVE-2025-49794/49796.

Trends and Outlook

Maintainer Daniel Veillard's "no embargo" policy (July 2025) will accelerate 0-day publication but also reflects open-source maintainer fatigue. Looking ahead, AI-driven fuzzing (e.g., syzkaller) is expected to surface more memory bugs through 2026, potentially affecting XML-based protocols. Recommendations: integrate SBOM tooling (e.g., CycloneDX) for supply chain monitoring and track zero-day response services from Red Hat and Seal Security.