libxslt CVE-2025-11731
LOWAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSLT stylesheet with document-node return
-
DeliveryDeliver to victim
-
ExploitVictim processes stylesheet via libxslt
-
ExecutionexsltFuncResultComp misidentifies node type
-
PersistType confusion triggers out-of-bounds memory read
-
ImpactApplication crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target application to process an untrusted XSLT stylesheet that uses EXSLT and contains a <func:result> element returning a document node. Exploitation is limited by high attack complexity and the need for user interaction (e.g., opening a crafted file or submitting a stylesheet to an online service). |
| Impact | CVSS 3.1 base score 3.1 (Low) reflects the high attack complexity and user interaction required for exploitation, with only availability impact. EPSS probability is 0.07% (20th percentile), indicating very low real-world exploitation likelihood. No active exploitation is known (not in CISA KEV) and no public exploit has been identified. Though any type confusion in a widely used library warrants attention, the actual risk is minimal given the exploitation prerequisites. |
| Exploit ScenarioDerived | An attacker crafts a malicious XSLT stylesheet that returns a document node from a <func:result> element and lures a user into processing it via a libxslt-based application. The type confusion triggers an unexpected memory access, crashing the application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Denial of service in libxslt via type confusion when processing EXSLT <func:result> elements during stylesheet compilation. Remote attackers can crash applications using the library by providing a crafted XSLT document, with high attack complexity and user interaction required.
RemediationAI
Apply the patch from merge request #78 at https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78. Red Hat customers should follow RHSA-2026:11015. As a workaround, restrict processing of XSLT stylesheets from untrusted sources or disable EXSLT function extensions if the application permits.
Affected ProductsAI
libxslt (GNOME XSLT library) all versions prior to the fix in merge request #78 on GNOME GitLab are affected. No specific CPE identifiers were provided. Red Hat issued RHSA-2026:11015 for its affected distributions; the vulnerability is tracked in GitLab issue #151.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the exsltFuncResultComp() function of libxslt, the GNOME XSLT processing library. When compiling an EXSLT func:result element that returns a document node, improper type checking causes a document node to be handled as an element node (CWE-843). This type confusion can lead to out-of-bounds memory reads and unrecoverable process crashes. The library is a core XML processing component in many Linux distributions and applications.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Network attack vector, high complexity due to specific type confusion, no privileges, user interaction required; only availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB