CVE-2025-10911

MediumCVSS 5.5/10Last modified Nov 5, 2026

Description

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-825

Affected software

VendorProductVersions
——<= 1.1.43
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Discovery 2—
Red HatRed Hat Hardened Images—
Red HatRed Hat OpenShift AI 3.4—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Update Infrastructure 5—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat OpenShift Container Platform 4—
Red HatRed Hat OpenShift Container Platform 4—

References

Timeline

Published
Sep 25, 2025
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-109125.4Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows ManipulaCVE-2025-109138.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet CVE-2025-109147.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd. Co. OBS (SCVE-2025-109159.8The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.CVE-2025-109169.1The FormGent WordPress plugin before 1.0.4 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes itCVE-2025-109187.1Insecure default permissions in the agent of Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to write CVE-2025-109207.8GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrCVE-2025-109217.8GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2025-109227.8GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2025-109237.8GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitraryCVE-2025-109247.8GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cCVE-2025-109257.8GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut
CVE-2025-10911: Medium severity, CVSS 5.5 | Vulnix