Description
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
Metrics
CVSS 3.1 7.8/10
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| GNOME | libxml2 | < 2.15.2 |
| Red Hat | Red Hat Enterprise Linux 10 | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8 | — |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9 | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — |
| Red Hat | Red Hat Web Terminal 1.11 on RHEL 9 | — |
| Red Hat | Red Hat Web Terminal 1.12 on RHEL 9 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | RHOSS-1.36-RHEL-8 | — |
| Red Hat | cert-manager operator for Red Hat OpenShift 1.16 | — |
| Red Hat | OpenShift Compliance Operator 1 | — |
| Red Hat | OpenShift Compliance Operator 1 | — |
| Red Hat | OpenShift Compliance Operator 1 | — |
| Red Hat | OpenShift File Integrity Operator - FIO 1 | — |
| Red Hat | Red Hat Discovery 2 | — |
| Red Hat | Red Hat Hardened Images | — |
| Red Hat | Red Hat Insights proxy 1.5 | — |
| Red Hat | Red Hat OpenShift distributed tracing 3.5.3 | — |
| Red Hat | Red Hat OpenShift distributed tracing 3.5.3 | — |
References
- https://access.redhat.com/errata/RHBA-2025:12345
- https://access.redhat.com/errata/RHSA-2025:12447
- https://access.redhat.com/errata/RHSA-2025:12450
- https://access.redhat.com/errata/RHSA-2025:13267
- https://access.redhat.com/errata/RHSA-2025:13308
- https://access.redhat.com/errata/RHSA-2025:13309
- https://access.redhat.com/errata/RHSA-2025:13310
- https://access.redhat.com/errata/RHSA-2025:13311
- https://access.redhat.com/errata/RHSA-2025:13312
- https://access.redhat.com/errata/RHSA-2025:13313
- https://access.redhat.com/errata/RHSA-2025:13314
- https://access.redhat.com/errata/RHSA-2025:13335
- https://access.redhat.com/errata/RHSA-2025:13464
- https://access.redhat.com/errata/RHSA-2025:13622
- https://access.redhat.com/errata/RHSA-2025:14059
- https://access.redhat.com/errata/RHSA-2025:14396
- https://access.redhat.com/errata/RHSA-2025:14818
- https://access.redhat.com/errata/RHSA-2025:14819
- https://access.redhat.com/errata/RHSA-2025:14853
- https://access.redhat.com/errata/RHSA-2025:14858
- https://access.redhat.com/errata/RHSA-2025:15308
- https://access.redhat.com/errata/RHSA-2025:15672
- https://access.redhat.com/errata/RHSA-2025:15827
- https://access.redhat.com/errata/RHSA-2025:15828
- https://access.redhat.com/errata/RHSA-2025:18219
- https://access.redhat.com/errata/RHSA-2025:21885
- https://access.redhat.com/errata/RHSA-2025:21913
- https://access.redhat.com/errata/RHSA-2026:0934
- https://access.redhat.com/errata/RHSA-2026:11503
- https://access.redhat.com/security/cve/CVE-2025-7425
- https://bugzilla.redhat.com/show_bug.cgi?id=2379274
- https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
- http://seclists.org/fulldisclosure/2025/Aug/0
- http://seclists.org/fulldisclosure/2025/Jul/30
- http://seclists.org/fulldisclosure/2025/Jul/32
- http://seclists.org/fulldisclosure/2025/Jul/35
- http://seclists.org/fulldisclosure/2025/Jul/37
- http://www.openwall.com/lists/oss-security/2025/07/11/2
- https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-577017.html
- https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
Timeline
- Published
- Jul 10, 2025
- Last modified
- Nov 6, 2026
- NVD status
- Deferred