CVE-2025-7424
highA flaw was found in the libxslt library.
Vendor / product: Xmlsoft — libxslt
A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.
CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2025-07-10 14:15
Modified: 2026-11-04 22:17
NVD status: Modified
Last synced 5 hours ago
Verified against the source API 2026-11-04 22:37 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
xmlsoft / libxslt all versions
redhat / openshift_container_platform 4.0
redhat / enterprise_linux 6.0, 7.0, 8.0, 9.0, 10.0
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://access.redhat.com/errata/RHBA-2025:12345 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2026:11015 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2025-7424 secalert@redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2379228 secalert@redhat.com
- https://gitlab.gnome.org/GNOME/libxslt/-/issues/139 secalert@redhat.com
- http://seclists.org/fulldisclosure/2025/Aug/0 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2025/Jul/30 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2025/Jul/32 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2025/Jul/33 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2025/Jul/35 af854a3a-2127-422b-91ae-364da2661108
- http://seclists.org/fulldisclosure/2025/Jul/37 af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2025/07/11/2 af854a3a-2127-422b-91ae-364da2661108
- https://lists.debian.org/debian-lts-announce/2025/09/msg00024.html af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-11-04 22:37 UTC · record ↗