7.8

CVE-2025-7425: gnome libxml2 Use After Free

CVSS: 7.8v3.1HighDeferred
AliasesSUSE-SU-2025:02547-1SUSE-SU-2025:02617-1SUSE-SU-2025:02620-1
Published 10-07-2025Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2025-7425 is a high (CVSS 7.8) Use After Free vulnerability in gnome libxml2. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.44%
0%100%
Low · +0.09 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 4
MGASA-2025-0269RHBA-2025:12345RHSA-2026:11503SUSE-SU-2025:20564-1SUSE-SU-2025:20607-1USN-7896-1

Timeline

  1. 10-07-2025
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

+0.09 pp

From 0.36% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse47 products
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 2.9.14-150400.5.47.1
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 2.9.14-150400.5.47.1
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 2.10.3-150500.5.32.1
  • libxml2-python&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 2.10.3-150500.5.32.1
  • libxml2-python&distro=SUSE Linux Enterprise Micro 5.3< 2.9.14-150400.5.47.1
Chainguard43 products
  • libxsltAll versions (No fix recorded)
  • libxslt-devAll versions (No fix recorded)
  • libxslt-docAll versions (No fix recorded)
  • libxslt-staticAll versions (No fix recorded)
  • openjdk-11-openj9< 0.59.0-r2
Redhat8 products
  • libxml2< 0:2.9.13-11.el9_6 | < 0:2.9.7-21.el8_10.2 | < 0:2.9.7-9.el8_2.4 | < 0:2.9.13-1.el9_0.6 | < 0:2.9.7-9.el8_4.7 | < 0:2.9.7-13.el8_6.11 | < 0:2.9.13-11.el9_4 | < 0:2.9.7-16.el8_8.10 | < 0:2.9.13-3.el9_2.8 | < 0:2.9.1-6.el7_9.12
  • libxml2-debuginfo< 0:2.9.13-11.el9_6 | < 0:2.9.7-21.el8_10.2 | < 0:2.9.7-9.el8_2.4 | < 0:2.9.13-1.el9_0.6 | < 0:2.9.7-9.el8_4.7 | < 0:2.9.7-13.el8_6.11 | < 0:2.9.13-11.el9_4 | < 0:2.9.7-16.el8_8.10 | < 0:2.9.13-3.el9_2.8 | < 0:2.9.1-6.el7_9.12
  • libxml2-debugsource< 0:2.9.13-11.el9_6 | < 0:2.9.7-21.el8_10.2 | < 0:2.9.7-9.el8_2.4 | < 0:2.9.13-1.el9_0.6 | < 0:2.9.7-9.el8_4.7 | < 0:2.9.7-13.el8_6.11 | < 0:2.9.13-11.el9_4 | < 0:2.9.7-16.el8_8.10 | < 0:2.9.13-3.el9_2.8
  • libxml2-devel< 0:2.9.13-11.el9_6 | < 0:2.9.7-21.el8_10.2 | < 0:2.9.7-9.el8_2.4 | < 0:2.9.13-1.el9_0.6 | < 0:2.9.7-9.el8_4.7 | < 0:2.9.7-13.el8_6.11 | < 0:2.9.13-11.el9_4 | < 0:2.9.7-16.el8_8.10 | < 0:2.9.13-3.el9_2.8 | < 0:2.9.1-6.el7_9.12
  • libxml2-python< 0:2.9.1-6.el7_9.12
Opensuse4 products
  • libxml2-python&distro=openSUSE Leap 15.6< 2.10.3-150500.5.32.1
  • libxml2&distro=openSUSE Leap 15.6< 2.10.3-150500.5.32.1
  • libxml2&distro=openSUSE Tumbleweed< 2.13.8-3.1
  • python-libxml2-python&distro=openSUSE Leap 15.6< 2.9.7-150000.3.85.1
Wolfi4 products
  • libxsltAll versions (No fix recorded)
  • libxslt-devAll versions (No fix recorded)
  • libxslt-docAll versions (No fix recorded)
  • libxslt-staticAll versions (No fix recorded)
Debian2 products
  • libxml2< 2.9.14+dfsg-1.3~deb12u4 | < 2.12.7+dfsg+really2.9.14-2.1+deb13u1
  • libxsltAll versions (No fix recorded)
Ubuntu2 products
  • libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm10 | < 2.9.3+dfsg1-1ubuntu0.7+esm11 | < 2.9.4+dfsg1-6.1ubuntu1.9+esm6 | < 2.9.10+dfsg-5ubuntu0.20.04.10+esm3 | < 2.9.13+dfsg-1ubuntu0.10 | < 2.9.14+dfsg-1.3ubuntu3.6
  • libxsltAll versions (No fix recorded)
Gnome1 product

8 vendors · 111 products

References

72 links
Show all 72 references