Log in Start free

Vulnerability · Published Jul 10, 2025 · Assigned by redhat

CVE-2025-7424Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

High 7.5

In plain English

A high-severity type confusion in libxslt from GNOME. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libxslt1.1.35-1+deb12u2DSA-5979-1
Debian:12libxslt1.1.35-1+deb12u2DEBIAN-CVE-2025-7424
Debian:13libxslt1.1.35-1.2+deb13u1DSA-5979-1
Debian:13libxslt1.1.35-1.2+deb13u1DEBIAN-CVE-2025-7424
Debian:14libxslt1.1.35-2DEBIAN-CVE-2025-7424
Ubuntu:22.04:LTSlibxslt1.1.34-4ubuntu0.22.04.5UBUNTU-CVE-2025-7424
Ubuntu:24.04:LTSlibxslt1.1.39-0exp1ubuntu0.24.04.3UBUNTU-CVE-2025-7424

Affected products (as reported)

VendorProductVersions
GNOME libxslt 0 – before 1.1.44
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Hardened Images see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References