High severity · published Jul 10, 2025
CVE-2025-7424
Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 6 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Hardened Images · Red Hat
All versions, or not specified · source: vendor
LI
libxslt · GNOME
before 1.1.44 · source: vendor, NVD
EL
Enterprise Linux · Redhat
6.0; 7.0; 8.0; 9.0; 10.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7424
vendor-advisory
https://access.redhat.com/errata/RHBA-2025:12345
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:11015
vdb-entry
https://access.redhat.com/security/cve/CVE-2025-7424
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2379228
gitlab.gnome.org
https://gitlab.gnome.org/GNOME/libxslt/-/issues/139