CVE-2025-49795

What it actually does

A NULL pointer dereference occurs in libxml2 during XPath XML expression processing, causing the affected process to crash when supplied with crafted malicious XML input.

Why it matters to the business

Attackers can trigger denial-of-service crashes in applications that parse XML, resulting in service outages and potential loss of availability for dependent systems.

How an attack unfolds

An attacker crafts a malicious XML document containing specific XPath expressions designed to trigger the null dereference, then supplies the input to an application using libxml2 such as through file processing or network requests, leading to an immediate crash.

How to fix it

Upgrade to the fixed package version claws-mail 3.11.1-3.1.mga5 or apply any upstream libxml2 patches that resolve the NULL pointer dereference in XPath handling.

How to confirm the fix worked

Confirm the installed version of libxml2 or the affected application meets or exceeds the fixed version; test parsing of known malicious XPath samples in a controlled environment to verify absence of crashes.

Typical attack path

1. Craft malicious XML input containing XPath expressions that trigger the null dereference
2. Deliver the XML payload to the target application via supported input channels
3. Trigger XML parsing and XPath evaluation in libxml2
4. Cause application process to crash due to the dereference

How to detect it

Review application and system logs for crashes or segmentation faults occurring during XML or XPath processing; correlate with timestamps of unexpected service restarts.

What your security team should do

• Apply the listed fixed package version as soon as possible given the public disclosure
• Restrict processing of untrusted XML inputs where feasible until patched
• Monitor application logs for segmentation faults during XML parsing activities