Vulnerability details
CVE-2025-49795
GNOME libxml2Siemens RUGGEDCOM RST2428P
Libxml: null pointer dereference leads to denial of service (dos)
CVSS 3.1
7.5High
Official description
A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| GNOME | libxml2 | 2.10.0 ≤ v < 2.14.5 | CVEProject cvelistV5 (CNA) |
| Siemens | RUGGEDCOM RST2428P | v < V4.0 | CVEProject cvelistV5 (CNA) |
References and advisories
7- https://access.redhat.com/errata/RHSA-2025:10630 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2025:19020 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7519 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-49795 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2372379 issue-trackingx_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/932
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-06-16
- Last updated
- 2026-11-05
- State
- Published
- Assigner (CNA)
- redhat
Exploit prediction (EPSS)
0.59%
Probability of exploitation in 30 days
48.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-825Expired Pointer Dereference