What’s Vulnerable › Vulnerabilities

CVE-2025-7425: Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Description

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

Affected products

How to fix

Upgrade to a fixed version: Red Hat cert-manager operator for Red Hat OpenShift 1.16 v1.16.5-1760515757; Red Hat Compliance Operator 1 1.8.0; Red Hat OpenShift Container Platform 4.18 418.94.202508261658-0; Red Hat OpenShift File Integrity Operator - FIO 1 v1.3; Red Hat Discovery 2 2.0.1-1754478727; Red Hat Enterprise Linux 10 0:1.1.39-8.el10_0; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.9.1-6.el7_9.12; Red Hat Enterprise Linux 8 0:2.9.7-21.el8_10.2; Red Hat Enterprise Linux 8.2 Advanced Update Support 0:2.9.7-9.el8_2.4; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.9.7-9.el8_4.7; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.9.7-9.el8_4.7; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.9.7-13.el8_6.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-7425 or the next vulnerability affects your stack