Discovery API Icon
Discovery API
Security Advisory Icon
Security Advisory
Alpaquita LinuxStreamSecurity Advisory
Search Cve

CVE-2025-7425

Published: July 11, 2025Last modified: November 21, 2025

Description

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

Severity score breakdown

ParameterValue
Base score7.8
Attack VectorLOCAL
Attack complexityHIGH
Privileges requiredNONE
User interactionNONE
ScopeCHANGED
ConfidentialityNONE
Integrity impactHIGH
Availability impactHIGH
VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Notes

https://gitlab.gnome.org/GNOME/libxslt/-/issues/140 file gnome-libxslt-bug-140-apple-fix.diff The patch breaks libxml2 ABI

Status

ProductReleasePackageStatus
Alpaquita Linux23 LTSlibxsltVulnerable (1.1.37-r0)
StreamlibxsltVulnerable (1.1.37-r0)
Liberica JDK8jdk-fullFixed (8u472+11)
jre-fullFixed (8u472+11)
11jdk-fullFixed (11.0.29+12)
jre-fullFixed (11.0.29+12)
17jdk-fullFixed (17.0.17+15)
jre-fullFixed (17.0.17+15)
21jdk-fullFixed (21.0.9+15)
jre-fullFixed (21.0.9+15)
25jdk-fullFixed (25.0.1+13)
jre-fullFixed (25.0.1+13)

References

Published BELL-SAs

ON THIS PAGE