Technical impact
A NULL pointer dereference vulnerability exists in libxml2 when processing XPath XML expressions, allowing an attacker to craft malicious XML input that causes a denial of service by crashing the library. The flaw is a classic pointer handling weakness covered by CWE-825 and results in loss of availability for any application that relies on libxml2 to parse XML content. The impact is a denial of service on the affected process, which can ripple to higher‑level services that depend on that process, but does not directly compromise confidentiality or integrity.
Affected Systems
This issue affects Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, and Red Hat JBoss Core Services 2.4.62.SP2, all of which package libxml2 in a vulnerable state. Systems running these distributions or images should verify the libxml2 component and apply the appropriate update.
Risk and Exploitability
The CVSS score of 7.5 indicates a medium‑to‑high severity for availability loss. The EPSS score is listed as <1%, suggesting that exploitation is currently unlikely in the wild, and the vulnerability is not yet catalogued in the CISA KEV list. The likely attack vector is an attacker who can provide XML input to an application or service that uses libxml2, such as a web server or XML‑processing utility. Successful exploitation would result in a service crash or restart, forcing a denial of service for users of that service.
EUVD