- CVE-2025-49795: schematron: internal robustness fix in xmlSchematronFormatReport() - check the result of xmlXPathCompiledEval() before reading it, so a report whose select expression does not compile is handled on the existing early-exit path, releasing the compiled expression and the select string on the way out so a hostile schema cannot leak once per matching node per rule - CVE-2025-7425: tree/valid: security hardening for the three fields libxslt stores its own flags in - read xmlAttr.atype, xmlNode.extra and xmlDoc.properties through masking accessors so the upper bits set by libxslt cannot disturb libxml2's own ID bookkeeping