Listen to this Post
How the Mentioned CVE Works
CVE-2025-6021: Integer overflow in `xmlBuildQName` leads to stack-based buffer overflow, causing memory corruption or DoS.
CVE-2025-6170: Improper input size check in `xmllint` shell allows crashes or rare code execution.
CVE-2025-49794: Use-after-free in XPath parsing via crafted `sch:name` elements leads to crashes or undefined behavior.
CVE-2025-49795: NULL pointer dereference in XPath processing triggers DoS via malicious XML.
CVE-2025-49796: Memory corruption via crafted `sch:name` elements causes crashes or data corruption.
DailyCVE Form
Platform: libxml2
Version: < 2.11.7
Vulnerability: Multiple flaws
Severity: Critical/High/Low
Date: 2025-07-22
Prediction: Patch by 2025-08-15
What Undercode Say
xmllint --shell payload.xml gdb -ex 'run' --args ./vulnerable_xml_parser
// PoC for CVE-2025-49794 <sch:name path="...malicious_xpath..."/>
How Exploit
- Craft XML with oversized QNames (CVE-2025-6021).
- Feed long commands to `xmllint` shell (CVE-2025-6170).
- Inject malicious `sch:name` paths (CVE-2025-49794/49796).
- Trigger NULL dereference via malformed XPath (CVE-2025-49795).
Protection from this CVE
- Upgrade to Nokogiri ≥1.18.9.
- Rebuild with patched libxml2 ≥2.11.7.
- Disable `xmllint` interactive shell.
Impact
- DoS via crashes.
- Memory corruption.
- Rare RCE (CVE-2025-6170).
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
