NULL Pointer Dereference Vulnerability in libxml2: Denial of Service Risk
Summary
CVE-2025-49795: A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. Affects libxml2 versions 2.12.3+dfsg-0exp1 – 2.9.14+dfsg-1.3~deb12u2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxml2 is a widely used XML parsing library that provides a variety of functionalities for processing XML documents. It is known for its performance and compliance with XML standards. However, it is susceptible to vulnerabilities that can be exploited through crafted XML input, leading to potential denial of service attacks.
Vulnerability Detail
A NULL pointer dereference vulnerability was discovered in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft malicious XML input that can cause the library to crash, resulting in a denial of service. The vulnerability arises from improper handling of certain XML expressions, which can lead to unexpected behavior when the library attempts to dereference a null pointer.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted XML input or implement strict validation of XML documents before processing them with libxml2. This can help mitigate the risk of triggering the vulnerability.
Conclusion
The NULL pointer dereference vulnerability in libxml2 poses a significant risk of denial of service through crafted XML input. It is crucial for users to update to the latest version of the library to mitigate this risk. Implementing workarounds can provide temporary relief until a full update can be performed.
See every vulnerability recorded for libxml2 →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json to the Vulert playground, you can check for vulnerabilities without needing to sign up.
The primary impact of this vulnerability is a denial of service, which can disrupt the availability of applications relying on libxml2 for XML processing.
Yes, updating to the latest patched version of libxml2 will mitigate this vulnerability. Always check the official repository for the most recent updates.
If immediate updates are not possible, implement strict validation of XML documents and avoid processing untrusted XML input to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for libxml2.
