CVE-2025-49794

What it actually does

Use-after-free during XPath element parsing in libxml2 when XML schematron contains <sch:name path="..."/> elements, resulting in memory corruption that can crash the process or trigger other undefined behavior.

Why it matters to the business

Applications that parse untrusted XML documents may experience crashes or data corruption, causing service outages; the issue affects a widely used library but has not been observed in active exploitation campaigns.

How an attack unfolds

An attacker creates a malicious XML document embedding a schematron schema with a crafted <sch:name path="..."/> element, then supplies the document to any application using the vulnerable libxml2 parser, causing the use-after-free during XPath processing.

How to fix it

Upgrade python-pillow on Mageia 5 to version 2.6.2-2.5.mga5 or later; rebuild or reinstall any dependent packages that ship the vulnerable libxml2 integration.

How to confirm the fix worked

Verify the installed python-pillow package version meets or exceeds the fixed release; attempt to parse a test XML document containing the triggering schematron construct and confirm absence of crashes.

Typical attack path

1. Craft malicious XML containing a schematron <sch:name path="..."/> element
2. Deliver the XML to a target application that uses libxml2 for parsing
3. Trigger XPath processing under the specific schematron conditions
4. Induce use-after-free leading to crash or undefined behavior

How to detect it

Review application and system logs for unexpected crashes or segmentation faults during XML or schematron processing; correlate with file uploads or parsing events around the time of the crash.

What your security team should do

• Apply the listed package update across all affected systems
• Scan for and replace any older python-pillow or libxml2 builds
• Add XML parsing crash monitoring to existing alerting