Description
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
Affected products
xmlsoft: libxslt; redhat: openshift container platform; redhat: enterprise linux
References10
- access.redhat.com/errata/RHBA-2025:12345
- access.redhat.com/errata/RHSA-2026:11015
- access.redhat.com/security/cve/CVE-2025-7424 Third Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2379228 Issue TrackingThird Party Advisory
- gitlab.gnome.org/GNOME/libxslt/-/issues/139
- seclists.org/fulldisclosure/2025/Aug/0
- seclists.org/fulldisclosure/2025/Jul/30
- seclists.org/fulldisclosure/2025/Jul/32
- seclists.org/fulldisclosure/2025/Jul/33
- seclists.org/fulldisclosure/2025/Jul/35
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 1% percentile: 71 · as of 7 November 2026
- CWE
- CWE-843
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.