What is the CVSS score of CVE-2025-11731?

CVE-2025-11731 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of libxslt are affected by CVE-2025-11731?

Denial of service in libxslt via type confusion when processing EXSLT elements during stylesheet compilation.

libxslt CVE-2025-11731

LOW

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2025-10-14 secalert@redhat.com

Denial Of Service Memory Corruption

3.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

3.1 LOW

Network attack vector, high complexity due to specific type confusion, no privileges, user interaction required; only availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:R/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 18:48 vuln.today

CVE Published

Oct 14, 2025 - 06:15 cve.org

LOW 3.1

DescriptionCVE.org

A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.

AnalysisAI

Denial of service in libxslt via type confusion when processing EXSLT <func:result> elements during stylesheet compilation. Remote attackers can crash applications using the library by providing a crafted XSLT document, with high attack complexity and user interaction required.

Technical ContextAI

The flaw resides in the exsltFuncResultComp() function of libxslt, the GNOME XSLT processing library. When compiling an EXSLT func:result element that returns a document node, improper type checking causes a document node to be handled as an element node (CWE-843). This type confusion can lead to out-of-bounds memory reads and unrecoverable process crashes. The library is a core XML processing component in many Linux distributions and applications.

Affected ProductsAI

libxslt (GNOME XSLT library) all versions prior to the fix in merge request #78 on GNOME GitLab are affected. No specific CPE identifiers were provided. Red Hat issued RHSA-2026:11015 for its affected distributions; the vulnerability is tracked in GitLab issue #151.

RemediationAI

Apply the patch from merge request #78 at https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78. Red Hat customers should follow RHSA-2026:11015. As a workaround, restrict processing of XSLT stylesheets from untrusted sources or disable EXSLT function extensions if the application permits.