Skip to main content

CVE-2025-7425

| EUVD-2025-20998 HIGH
Use After Free (CWE-416)
2025-07-10 secalert@redhat.com
Denial Of Service Memory Corruption Use After Free
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
7.8 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 16, 2026 - 06:52 euvd
EUVD-2025-20998
Analysis Generated
Mar 16, 2026 - 06:52 vuln.today
PoC Detected
Jan 22, 2026 - 05:16 vuln.today
Public exploit code
CVE Published
Jul 10, 2025 - 14:15 nvd
HIGH 7.8

DescriptionCVE.org

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

AnalysisAI

CVE-2025-7425 is a use-after-free (UAF) vulnerability in libxslt where improper memory management during XSLT tree fragment processing leads to heap corruption and potential code execution. The vulnerability affects libxslt library versions processing XSLT functions like key() that generate tree fragments, allowing local attackers with no privileges to trigger crashes or heap corruption through crafted XSLT stylesheets. While CVSS 7.8 indicates high severity, real-world impact depends on KEV inclusion status and whether public exploits exist; this vulnerability presents significant risk to applications embedding libxslt and processing untrusted XSLT input.

Technical ContextAI

libxslt is a widely-used XSLT 1.0 processor library (CPE: cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*) that transforms XML documents using stylesheets. The vulnerability roots in CWE-416 (Use After Free), where the internal attribute type field (atype) and associated flags become corrupted during XSLT key() function processing when tree fragments are generated. This corruption prevents proper cleanup and dereferencing of ID attributes, leaving dangling pointers. When the memory management cleanup routines subsequently attempt to access these freed ID attribute structures, the system dereferences invalid memory addresses. This is particularly dangerous because XSLT tree fragments are temporary data structures created during dynamic XSLT function evaluation, and improper state management during their lifecycle directly leads to use-after-free conditions.

RemediationAI

  1. IMMEDIATE: Update libxslt to the patched version (typically 1.1.39 or later, pending official release confirmation). 2. Distribution-specific patches: Monitor Red Hat Security Advisory (RHSA), Debian Security Advisory (DSA), Ubuntu Security Notice (USN), and other vendor-specific channels for backported patches to maintained versions. 3. WORKAROUND (temporary): Restrict XSLT stylesheet sources to trusted, pre-validated input only; disable XSLT processing if not required; use XSLT sandboxing via operating system controls (containers, seccomp, AppArmor) to limit impact of potential heap corruption. 4. VALIDATION: Recompile dependent applications against patched libxslt version; regression test XSLT transformations, especially those using key() function and tree fragment generation. 5. MONITORING: Deploy runtime heap corruption detection (AddressSanitizer, Valgrind in non-production diagnostics) to catch exploitation attempts; monitor for segmentation faults or unexpected process terminations in XSLT processing workflows.

Vendor StatusVendor

Ubuntu

Priority: Medium
libxslt
Release Status Version
oracular ignored end of life, was needs-triage
bionic not-affected code not present
focal not-affected code not present
jammy not-affected code not present
xenial not-affected code not present
noble deferred 2026-03-03
questing deferred 2026-03-03
upstream deferred 2026-03-03
plucky ignored end of life, was deferred [2026-03-03]
trusty not-affected code not present
libxml2
Release Status Version
questing not-affected 2.14.5+dfsg-0.2
jammy released 2.9.13+dfsg-1ubuntu0.10
bionic released 2.9.4+dfsg1-6.1ubuntu1.9+esm6
focal released 2.9.10+dfsg-5ubuntu0.20.04.10+esm3
trusty released 2.9.1+dfsg1-3ubuntu4.13+esm10
upstream released 2.14.5+dfsg-0.1
noble released 2.9.14+dfsg-1.3ubuntu3.6
plucky released 2.12.7+dfsg+really2.9.14-0.4ubuntu0.4
xenial released 2.9.3+dfsg1-1ubuntu0.7+esm11
USN-7852-1 USN-7852-2 USN-7896-1

Debian

Bug #1109122
libxslt
Release Status Fixed Version Urgency
bullseye not-affected - -
bullseye (security) fixed 1.1.34-4+deb11u3 -
bookworm, bookworm (security) fixed 1.1.35-1+deb12u3 -
trixie (security), trixie fixed 1.1.35-1.2+deb13u2 -
forky, sid vulnerable 1.1.43-0.3 -
bookworm not-affected - -
trixie not-affected - -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
Container bci/kiwi:latest Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container bci/spack:0.23.1-11.43 Container containers/lmcache-vllm-openai:0.3.2-1.2 Container containers/open-webui:0.6.9-11.12 Container containers/pytorch:2.7.0-nvidia-2.48 Container containers/vllm-openai:0.9.1-1.2 Container private-registry/harbor-db:2.12.2-2.17 Container private-registry/harbor-nginx:1.21.5-2.15 Container suse/manager/5.0/x86_64/proxy-salt-broker:5.0.5.1.7.28.2 Container suse/manager/5.0/x86_64/proxy-squid:5.0.5.1.7.26.1 Container suse/manager/5.0/x86_64/server-migration-14-16:5.0.5.1.7.26.2 Container suse/mariadb:10.11.11-70.13 Container suse/sle-micro/5.5/toolbox:14.2-3.12.73 Container suse/sle-micro/5.5:2.0.4-5.5.350 Container suse/sle-micro/base-5.5:2.0.4-5.8.196 Container suse/sle-micro/kvm-5.5:2.0.4-3.5.374 Container suse/sle-micro/rt-5.5:2.0.4-4.5.461 Image SLES15-SP5-Azure-3P Image SLES15-SP5-Azure-Basic Image SLES15-SP5-Azure-Standard Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-Aliyun Image SLES15-SP5-CHOST-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-EC2 Image SLES15-SP5-CHOST-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-GDC Image SLES15-SP5-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-Azure Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP6 Image SLES15-SP6-Azure-3P Image SLES15-SP6-Azure-Basic Image SLES15-SP6-Azure-Standard Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC Image SLES15-SP6-HPC-Azure Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image ai_15_6 Affected
Container private-registry/harbor-portal:1.1.0-1.1 Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.6.17.8.90 Container suse/multi-linux-manager/5.1/x86_64/proxy-httpd:5.1.1.8.9.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-salt-broker:5.1.1.9.7.2 Container suse/multi-linux-manager/5.1/x86_64/proxy-squid:5.1.1.8.7.1 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.1.8.7.1 Container suse/multi-linux-manager/5.1/x86_64/server-postgresql:5.1.2.6.13.1 Container suse/multi-linux-manager/5.1/x86_64/server-saline:5.1.2.9.13.1 Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-GCE-3P Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image proxy-httpd-image Image proxy-salt-broker-image Image proxy-squid-image Image server-database-migration-image Image server-image Image server-migration-14-16-image Image server-postgresql-image Image server-saline-image Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.114 Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected
Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.10 Image SLES15-SP4-Manager-Proxy-4-3-BYOS Image SLES15-SP4-Manager-Proxy-4-3-BYOS-Azure Image SLES15-SP4-Manager-Proxy-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Proxy-4-3-BYOS-GCE Affected

Share

CVE-2025-7425 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy