CVE-2025-10911
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A use-after-free vulnerability in libxslt while parsing xsl nodes can lead to dereference of expired pointers and application crash.
Risk Assessment
An attacker can crash applications using libxslt, leading to denial of service (DoS).
Recommendation
Update libxslt to the latest patched version. If not possible, avoid processing untrusted XSL files.
Other vulnerabilities in libxslt
See all- CVE-2019-18197High
In libxslt 1.1.33, the xsltCopyText function does not reset a pointer under certain circumstances. This may lead to writing data outside a buffer or disclosing uninitialized data.
- CVE-2016-4738High
libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2016-1684High
In libxslt before version 1.1.29, used in Google Chrome before version 51.0.2704.63, there is a mishandling of the i format token for xsl:number data. This allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.
- CVE-2016-1841High
libxslt in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2025-24855Medium
In libxslt before 1.1.43, numbers.c has a use-after-free because in nested XPath evaluations, an XPath context node can be modified but never restored. Affects xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
- CVE-2024-55549Medium
In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.
- CVE-2019-11068Critical
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
- CVE-2017-2477Critical
An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'libxslt' component. This issue may lead to denial of service (memory corruption) or potentially other unspecified impacts via unknown vectors.
- CVE-2016-4610Critical
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 has a vulnerability that allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
- CVE-2016-4609Critical
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Original NVD description (English source)
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS