CVE-2025-24855: xmlsoft libxslt Use After Free
CVSS: 7.8v3.1HighModified
AliasesALPINE-CVE-2025-24855RHSA-2025:3107RHSA-2025:3389RHSA-2025:3528UBUNTU-CVE-2025-24855USN-7361-1DEBIAN-CVE-2025-24855CGA-4m3g-699x-qgxqCGA-wwqv-2hhh-7qpcCGA-23gh-m2cr-xqhmCGA-2q3f-gm7v-j55mCGA-4q4f-mcj4-8x2wCGA-5hhx-ppmv-7vmvCGA-6825-57wf-p3c7CGA-7hx7-cj29-g2m8CGA-7r3r-g7v6-28m7CGA-8m69-jcgh-qwv6CGA-9mvv-gvmm-fqpqCGA-c3gc-p237-v2wgCGA-c4qg-v8v9-8m46CGA-cc4j-3c6v-jwj3CGA-cj2q-36vw-4w9xCGA-f3p9-373g-x778CGA-fphq-w6wm-46g4CGA-g5m5-j7c8-fc47CGA-gp27-gw7f-955hCGA-j242-59qg-224gCGA-m6xc-m68r-h5rfCGA-p75c-2rgc-h95cCGA-pcg2-3r62-rgmrCGA-phhv-cjrw-7vwvCGA-pm7w-3q2m-mpq6CGA-r47m-4794-6m5xCGA-r58w-whf9-wc85CGA-rqh7-rwvc-mqv7CGA-vv8h-h524-9ppqCGA-w52r-v8v2-4j83CGA-w7jc-689x-pj58CGA-w7jj-r4vf-99wmCGA-xv8h-x6pw-72q7CGA-xx36-2wh7-h4w3
Published 14-03-2025Last modified 26-02-2026
Vulnerability summary
CVE-2025-24855 is a high (CVSS 7.8) Use After Free vulnerability in xmlsoft libxslt. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.8/10
010
High · v3.1 (CVE.org)EPSS score
0.36%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 20 · Related 13DLA-4089-1DSA-5884-1MGASA-2025-0110OPENSUSE-SU-2025:14894-1OPENSUSE-SU-2025:15531-1RHSA-2025:3612RHSA-2025:3615RHSA-2025:3619RHSA-2025:3624RHSA-2025:3625RHSA-2025:3626RHSA-2025:3627RHSA-2025:4098RHSA-2025:7496SUSE-SU-2025:1003-1SUSE-SU-2025:1125-1SUSE-SU-2025:1494-1SUSE-SU-2025:20201-1SUSE-SU-2025:20277-1USN-7787-1CGA-4R4M-X253-HHR9CGA-GF4G-8XW3-XQPRCGA-JCC3-4R8F-8MRRCGA-JHX9-P2RX-7277CGA-V52J-478R-MH2X
Timeline
- 14-03-2025PublishedVulnerability first disclosed.
- 26-02-2026Last modifiedVulnerability information updated.
Description
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
CVSS metrics
8 scores · 8 sources · 1 versionHigh 7.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:HSourcesAll 8 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
+0.01 pp
From 0.35% on 19-09-2026
19-09-202619-10-2026
EPSS score0.36%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- openjdk-11-openj9-default-policy< 0.53.0-r0
- openjdk-17-openj9-default-policy< 0.53.0-r0
- openjdk-21-openj9-default-policy< 0.53.0-r0
- openjdk-25-openj9< 0.59.0-r1
- openjdk-25-openj9-dbg< 0.59.0-r1
Redhat4 products
- libxslt< 0:1.1.34-9.el9_5.1 | < 0:1.1.34-10.el9_4 | < 0:1.1.34-10.el9_2
- libxslt-debuginfo< 0:1.1.34-9.el9_5.1 | < 0:1.1.34-10.el9_4 | < 0:1.1.34-10.el9_2
- libxslt-debugsource< 0:1.1.34-9.el9_5.1 | < 0:1.1.34-10.el9_4 | < 0:1.1.34-10.el9_2
- libxslt-devel< 0:1.1.34-9.el9_5.1 | < 0:1.1.34-10.el9_4 | < 0:1.1.34-10.el9_2
Alpine1 product
- libxslt< 1.1.38-r1 | < 1.1.39-r1 | < 1.1.39-r2 | < 1.1.42-r2 | < 1.1.43-r0
Debian1 product
- libxslt< 1.1.35-1+deb12u1 | < 1.1.35-1.2
Ubuntu1 product
- libxslt< 1.1.28-2ubuntu0.2+esm4 | < 1.1.28-2.1ubuntu0.3+esm3 | < 1.1.29-5ubuntu0.3+esm2 | < 1.1.34-4ubuntu0.20.04.3 | < 1.1.34-4ubuntu0.22.04.3 | < 1.1.39-0exp1ubuntu0.24.04.2
Wolfi1 product
- openjdk-7-jreAll versions (No fix recorded)
Xmlsoft1 product
- libxslt< 1.1.43
7 vendors · 26 products
