A flaw in libxml2’s handling of certain sch:name elements can corrupt memory. When an attacker supplies a tailored XML file, libxml processes it and may write beyond the bounds of the stack or heap, which causes the library to crash. The resulting denial of service is amplified by the possibility that sensitive data could also be overwritten, potentially exposing confidential information or enabling further exploitation if memory corruption is abused.

Red Hat customers running libxml2 on multiple Red Hat distributions and products are impacted, including Enterprise Linux 6, 7, 8, 9, 10, the Red Hat Enterprise Linux Extended Update Supports (e.g., 8.2, 8.4, 8.6, 8.8, 9.0, 9.2, 9.4), the Red Hat Hardened Images, RHOSS OpenShift and Serverless components (4.12 through 4.20), Red Hat Discovery, Red Hat Insights Proxy, Red Hat JBoss Core Services, Red Hat Web Terminal (1.11 and 1.12 on RHEL 9), and the cert‑manager operator (1.16). All listed versions are mentioned in the referenced errata.

The CVSS score of 9.1 classifies this as critical, and the EPSS of 2% indicates a moderate likelihood that exploit code could surface. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the impact on core XML processing libraries mean that any service parsing untrusted XML is at risk. The attack path evidently requires the attacker to supply or influence the XML content; once that is done, an out‑of‑bounds read (CWE‑125) leads to a crash, disabling the affected service.