libxml2: memory corruption in sch:name (CVE-2025-49796)
A vulnerability was found in libxml2: processing certain sch:name elements (Schematron) in an input XML file can trigger memory corruption. The CVE carries a CVSS score of 9.1.
Checked in Shield: no
Who is affected
Systems where libxml2 parses untrusted XML with Schematron validation. Affected versions are not stated in the source.
How to check
Check the installed version with dpkg -l | grep libxml2 and compare it with the Debian security tracker. Find out whether Schematron validation is used, including inside Docker images.
How to fix
The source does not name a fixed version. Watch for distribution updates and rebuild images after base packages are updated.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Affected and fixed versions and any exploitation are not disclosed yet. Source: NVD.
