CVE-2025-7424
Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes
- State
- Published
- Severity
- 7.5 High
- Published
- Jul 10, 2025
- Updated
- Oct 12, 2026
- Reserved
- Jul 10, 2025
Description
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | redhat |
Weaknesses
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
Affected Products
| Product | Versions |
|---|---|
libxsltGNOME |
|
Red Hat Enterprise Linux 10Red Hat |
|
Red Hat Hardened ImagesRed Hat |
|
Red Hat Enterprise Linux 6Red Hat | |
Red Hat Enterprise Linux 7Red Hat | |
Red Hat Enterprise Linux 8Red Hat | |
Red Hat Enterprise Linux 9Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat | |
Red Hat OpenShift Container Platform 4Red Hat |
References
- RHBA-2025:12345vendor-advisory
- RHSA-2026:11015vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-7424vdb-entry
- RHBZ#2379228issue-tracking
- https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
- https://lists.debian.org/debian-lts-announce/2025/09/msg00024.html
- http://seclists.org/fulldisclosure/2025/Aug/0
- http://seclists.org/fulldisclosure/2025/Jul/37
- http://seclists.org/fulldisclosure/2025/Jul/35
- http://seclists.org/fulldisclosure/2025/Jul/33
- http://seclists.org/fulldisclosure/2025/Jul/32
- http://seclists.org/fulldisclosure/2025/Jul/30
- http://www.openwall.com/lists/oss-security/2025/07/11/2
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.