Red Hat libxml2 Updates Address CVE-2025-6170
Tech GuruQuick Answer
These Red Hat updates fix CVE-2025-6170 in the interactive shell of xmllint, supplied with libxml2. The branch fixes are 2.9.13-12.el9_6.3 for RHEL 9.6 extended support and 2.12.5-9.el10_0.2 for RHEL 10.0 extended support. Match the entitled stream and actual tool path; this notice does not establish that every XML-processing service is remotely exploitable.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory RHEL 9.6 and 10.0 extended-support libxml2 packages, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Source recheck: October 2, 2026 UTC, against Red Hat's structured CSAF advisory. The dates above distinguish initial issue from current CSAF generation. Confirm repository entitlement and installed/running package state locally before closing the change.
Scope And Authority
| Product scope | RHEL 9.6 and 10.0 extended-support libxml2 packages |
|---|---|
| Advisory | RHSA-2026:70639 / RHSA-2026:70596 |
| CVE | CVE-2025-6170 |
| Authoritative release date | RHSA-2026:70639: 2026-09-23T10:29:51+00:00 RHSA-2026:70596: 2026-09-23T08:15:46+00:00 |
| Authority revision date | RHSA-2026:70639: 2026-10-02T02:18:24+00:00 (CSAF current generation) RHSA-2026:70596: 2026-10-02T02:18:23+00:00 (CSAF current generation) |
| Affected versions | The exact entitled RHEL 9.6 and 10.0 extended-support libxml2 packages builds before the branch-specific fixed packages listed by Red Hat |
| Fixed version | libxml2 2.9.13-12.el9_6.3 or 2.12.5-9.el10_0.2 |
| CVSS base score | 2.5 (CVSS v3.1) |
| CVSS severity | Low |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
An overly long command entered into xmllint's interactive shell can overflow its command buffer and crash the tool. Red Hat describes possible code execution in rare configurations without modern protections. The trigger is interactive command handling, not simply opening any XML document through a libxml2 consumer.
What To Validate Now
- Inventory. Record RHEL support stream, libxml2 package build, the xmllint binary actually invoked and any workflow exposing its interactive shell to untrusted commands.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled RHEL 9.6 and 10.0 extended-support libxml2 packages builds before the branch-specific fixed packages listed by Red Hat Do not infer applicability from product family or severity alone.
- Remediate. Apply libxml2 2.9.13-12.el9_6.3 or 2.12.5-9.el10_0.2 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the advisory-matched package and binary path, then run ordinary approved XML tooling checks in staging. Do not feed overflow payloads into a production shell or assume an unrelated application's successful XML parse proves the vulnerable command path fixed.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
