Search for vulnerabilities
Vulnerability details: VCID-15kx-qz81-87cu
Vulnerability ID VCID-15kx-qz81-87cu
Aliases CVE-2025-49795
Summary A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-825 Expired Pointer Dereference
System Score Found at
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2025:10630
ssvc Track https://access.redhat.com/errata/RHSA-2025:10630
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-49795.json
cvssv3.1 7.5 https://access.redhat.com/security/cve/CVE-2025-49795
ssvc Track https://access.redhat.com/security/cve/CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2025-49795
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=2372379
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2372379
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
archlinux High https://security.archlinux.org/AVG-2898
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-49795.json
https://api.first.org/data/v1/epss?cve=CVE-2025-49795
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
AVG-2898 https://security.archlinux.org/AVG-2898
cpe:/a:redhat:jboss_core_services:1 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_core_services:1
cpe:/o:redhat:enterprise_linux:10.0 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10.0
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
CVE-2025-49795 https://access.redhat.com/security/cve/CVE-2025-49795
RHSA-2025:10630 https://access.redhat.com/errata/RHSA-2025:10630
show_bug.cgi?id=2372379 https://bugzilla.redhat.com/show_bug.cgi?id=2372379
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2025:10630
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-16T15:30:23Z/ Found at https://access.redhat.com/errata/RHSA-2025:10630
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-49795.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/security/cve/CVE-2025-49795
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-16T15:30:23Z/ Found at https://access.redhat.com/security/cve/CVE-2025-49795
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2372379
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-06-16T15:30:23Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2372379
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.16867
EPSS Score 0.00054
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:19:58.511923+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/49xxx/CVE-2025-49795.json 37.0.0