CVE-2024-55549: xmlsoft libxslt Use After Free
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2024-55549RHSA-2025:3613RHSA-2025:3614RHSA-2025:4025RHSA-2025:7410UBUNTU-CVE-2024-55549USN-7357-1DEBIAN-CVE-2024-55549CGA-cjwq-j557-5m5cCGA-cvvq-p44w-vwv9CGA-47wh-vc2w-6rw9CGA-4cw7-gc6p-2vm2CGA-53g3-q5v7-3mgqCGA-54m4-rpwj-jpmmCGA-5m38-x7mr-c29qCGA-5p3j-54xc-m68fCGA-633r-8q8q-8c23CGA-6577-4g2c-9c6xCGA-6q2v-fhq9-8wg7CGA-6xfg-33qx-hc7mCGA-7866-q8qj-88q9CGA-7gxj-xhr4-5f97CGA-7vh9-mr5v-4rfwCGA-8x47-5rjx-7p55CGA-94qf-w3rh-vj82CGA-cgfg-j29w-qvh8CGA-ch6m-295r-pc4pCGA-fhpp-xmpv-m522CGA-fjjp-xcfx-wcv8CGA-fr32-ppxr-4xgmCGA-h2wg-42c4-42vjCGA-jcv8-v683-4p8hCGA-jfwh-82gq-mq4qCGA-m644-4mvp-j5rjCGA-prmh-38mm-fvm2CGA-px8q-p92f-72mwCGA-q582-3mmw-4xpqCGA-r844-p2pc-rw2wCGA-rwx5-5jvr-8mvcCGA-v3cc-37q3-wvv5CGA-w687-r8j8-2pf7CGA-x4j7-5gj6-fqxj
Published 14-03-2025Last modified 03-11-2025
Vulnerability summary
CVE-2024-55549 is a high (CVSS 7.8) Use After Free vulnerability in xmlsoft libxslt. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.1 (CVE.org)EPSS score
0.36%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 20 · Related 12DLA-4089-1DSA-5884-1MGASA-2025-0110OPENSUSE-SU-2025:14894-1OPENSUSE-SU-2025:15531-1RHSA-2025:3612RHSA-2025:3615RHSA-2025:3619RHSA-2025:3624RHSA-2025:3625RHSA-2025:3626RHSA-2025:3627RHSA-2025:4098RHSA-2025:7496SUSE-SU-2025:1003-1SUSE-SU-2025:1125-1SUSE-SU-2025:1494-1SUSE-SU-2025:20201-1SUSE-SU-2025:20277-1USN-7787-1CGA-3638-3329-35V8CGA-6F89-5RX7-VJ98CGA-HPFM-Q3C3-326JCGA-W7G2-8F5M-QWCC
Timeline
- 14-03-2025PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
CVSS metrics
8 scores · 8 sources · 1 versionHigh 7.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:HSourcesAll 8 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
+0.01 pp
From 0.35% on 18-09-2026
18-09-202618-10-2026
EPSS score0.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
Redhat4 products
- libxslt< 0:1.1.34-13.el9_4 | < 0:1.1.34-11.el9_2 | < 0:1.1.34-9.el9_5.2 | < 0:1.1.34-13.el9_6
- libxslt-debuginfo< 0:1.1.34-13.el9_4 | < 0:1.1.34-11.el9_2 | < 0:1.1.34-9.el9_5.2 | < 0:1.1.34-13.el9_6
- libxslt-debugsource< 0:1.1.34-13.el9_4 | < 0:1.1.34-11.el9_2 | < 0:1.1.34-9.el9_5.2 | < 0:1.1.34-13.el9_6
- libxslt-devel< 0:1.1.34-13.el9_4 | < 0:1.1.34-11.el9_2 | < 0:1.1.34-9.el9_5.2 | < 0:1.1.34-13.el9_6
Alpine1 product
- libxslt< 1.1.38-r1 | < 1.1.39-r1 | < 1.1.39-r2 | < 1.1.42-r2 | < 1.1.43-r0
Debian1 product
- libxslt< 1.1.35-1+deb12u1 | < 1.1.35-1.2
Ubuntu1 product
- libxslt< 1.1.28-2ubuntu0.2+esm4 | < 1.1.28-2.1ubuntu0.3+esm3 | < 1.1.29-5ubuntu0.3+esm2 | < 1.1.34-4ubuntu0.20.04.2 | < 1.1.34-4ubuntu0.22.04.2 | < 1.1.39-0exp1ubuntu0.24.04.1
Wolfi1 product
- openjdk-7-jreAll versions (No fix recorded)
Xmlsoft1 product
- libxslt< 1.1.43
7 vendors · 26 products
