A use‑after‑free occurs in libxml2 when parsing an XML document that contains a schematron <sch:name path="..."/> element. The flaw allows an attacker to craft a malicious XML file that causes libxml2 to dereference freed memory, leading to a crash or other undefined behavior. The result is a denial of service, with the application terminating unexpectedly. This is a classic CWE‑825 issue.

The affected products are all Red Hat offerings that ship libxml2, including Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as several Red Hat OpenShift Container Platforms (4.12 through 4.20) and the cert‑manager operator for OpenShift. Multiple Red Hat Insights, Automatic Update Services, and hardened images are also impacted.

The CVSS score of 9.1 indicates a high‑severity vulnerability, while the EPSS score of less than 1% suggests low overall exploitation probability. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is the exposure of a component that processes XML input; an attacker who can supply a crafted XML document can trigger the crash, which may be performed locally or remotely depending on the application’s exposure. Continued monitoring for unexpected crashes can help detect attempts while a patch is applied.