CVE-2025-7425
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A flaw in libxslt allows modification of attribute type flags (atype), corrupting internal memory management. During XSLT functions like key(), tree fragments prevent proper cleanup of ID attributes, leading to use-after-free conditions.
Risk Assessment
Attackers can exploit this vulnerability to cause system crashes or heap corruption, potentially leading to denial of service or arbitrary code execution.
Recommendation
Update libxslt to the latest patched version immediately. If not possible, restrict processing of untrusted XSLT stylesheets.
Other vulnerabilities in libxslt
See all- CVE-2019-18197High
In libxslt 1.1.33, the xsltCopyText function does not reset a pointer under certain circumstances. This may lead to writing data outside a buffer or disclosing uninitialized data.
- CVE-2016-4738High
libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2016-1684High
In libxslt before version 1.1.29, used in Google Chrome before version 51.0.2704.63, there is a mishandling of the i format token for xsl:number data. This allows remote attackers to cause a denial of service (integer overflow or resource consumption) or possibly have unspecified other impact via a crafted document.
- CVE-2016-1841High
libxslt in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2024-55549Medium
In libxslt before 1.1.43, xsltGetInheritedNsList has a use-after-free issue related to exclusion of result prefixes.
- CVE-2025-24855Medium
In libxslt before 1.1.43, numbers.c has a use-after-free because in nested XPath evaluations, an XPath context node can be modified but never restored. Affects xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
- CVE-2019-11068Critical
libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permit access even upon receiving a -1 error code. xsltCheckRead can return -1 for a crafted URL that is not actually invalid and is subsequently loaded.
- CVE-2017-2477Critical
An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'libxslt' component. This issue may lead to denial of service (memory corruption) or potentially other unspecified impacts via unknown vectors.
- CVE-2016-4610Critical
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 has a vulnerability that allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
- CVE-2016-4609Critical
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Original NVD description (English source)
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.