Read the docs
TI-2025-18564 Aliases CVE-2025-24855GHSA-3cgj-v3m4-cgcq

Use after free in xmlsoft libxslt

Priority LOW 36CWE-416Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 33 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00358 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial libxslt (xmlsoft): 1.1.43Red Hat: 19 advisoriesRed Hat: 33 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
xmlsoftlibxsltbefore 1.1.431.1.43Patch availableCNA
  • libxslt Vendorxmlsoft Affected before 1.1.43 Fixed in 1.1.43 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:*before 1.1.43Vulnerablexmlsoft
  • cpe:2.3:a:xmlsoft:libxslt:*:*:*:*:*:*:*:* Versions before 1.1.43 Vulnerable ·xmlsoft

Remediation

  • Fix · CNA libxslt (xmlsoft) Fixed in 1.1.43

Red Hat 19 advisories

  • RHSA-2025:9278 Released 2025-06-24 · Red Hat rating Important
    OpenShift Container Platform 4.19.1 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 openshift4/aws-karpenter-provider-aws-rhel9, openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2025:8303 Released 2025-06-05 · Red Hat rating Important
    OpenShift Container Platform 4.12.77 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 openshift4/driver-toolkit-rhel8, openshift4/network-tools-rhel8, openshift4/ose-baremetal-installer-rhel8 +17
  • RHSA-2025:7702 Released 2025-05-21 · Red Hat rating Important
    OpenShift Container Platform 4.14.52 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel8, openshift4/ose-hypershift-rhel8 +1
Show 16 more Red Hat advisories
  • RHSA-2025:4677 Released 2025-05-15 · Red Hat rating Important
    OpenShift Container Platform 4.13.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-agent-installer-node-agent-rhel8, openshift4/ose-agent-installer-orchestrator-rhel8 +6
  • RHSA-2025:4731 Released 2025-05-15 · Red Hat rating Important
    OpenShift Container Platform 4.16.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/driver-toolkit-rhel9, openshift4/network-tools-rhel9, openshift4/openshift-route-controller-manager-rhel9 +30
  • RHSA-2025:7496 Released 2025-05-13 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream (v. 10) libxslt-1.1.39-7.el10_0, libxslt-devel-1.1.39-7.el10_0
  • RHSA-2025:4431 Released 2025-05-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.28 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/ose-olm-operator-controller-rhel9, rhcos
  • RHSA-2025:4427 Released 2025-05-09 · Red Hat rating Important
    OpenShift Container Platform 4.18.12 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-console-rhel9, openshift4/ose-olm-catalogd-rhel9 +1
  • RHSA-2025:4422 Released 2025-05-08 · Red Hat rating Important
    OpenShift Container Platform 4.15.50 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-agent-installer-orchestrator-rhel8, openshift4/ose-baremetal-rhel9-operator +4
  • RHSA-2025:4098 Released 2025-04-23 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) libxslt-1.1.28-9.el7_9, libxslt-1.1.28-9.el7_9.ppc, libxslt-devel-1.1.28-9.el7_9 +1
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) libxslt-python-1.1.28-9.el7_9
  • RHSA-2025:3627 Released 2025-04-07 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libxslt-1.1.34-11.el9_0, libxslt-devel-1.1.34-11.el9_0
  • RHSA-2025:3624 Released 2025-04-07 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) libxslt-devel-1.1.32-8.el8_8
    • Red Hat Enterprise Linux BaseOS EUS (v.8.8) libxslt-1.1.32-8.el8_8
  • RHSA-2025:3625 Released 2025-04-07 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libxslt-devel-1.1.32-8.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libxslt-devel-1.1.32-8.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libxslt-devel-1.1.32-8.el8_6
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxslt-1.1.32-8.el8_6
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) libxslt-1.1.32-8.el8_6
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libxslt-1.1.32-8.el8_6
  • RHSA-2025:3626 Released 2025-04-07 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libxslt-devel-1.1.32-8.el8_4
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) libxslt-devel-1.1.32-8.el8_4
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) libxslt-devel-1.1.32-8.el8_4
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libxslt-1.1.32-8.el8_4
    • Red Hat Enterprise Linux BaseOS E4S (v.8.4) libxslt-1.1.32-8.el8_4
    • Red Hat Enterprise Linux BaseOS TUS (v.8.4) libxslt-1.1.32-8.el8_4
  • RHSA-2025:3619 Released 2025-04-07 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libxslt-devel-1.1.32-6.el8_2
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libxslt-1.1.32-6.el8_2
  • RHSA-2025:3615 Released 2025-04-07 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream (v. 8) libxslt-devel-1.1.32-6.1.el8_10
    • Red Hat Enterprise Linux BaseOS (v. 8) libxslt-1.1.32-6.1.el8_10
  • RHSA-2025:3528 Released 2025-04-02 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) libxslt-1.1.34-10.el9_2, libxslt-devel-1.1.34-10.el9_2
  • RHSA-2025:3389 Released 2025-03-31 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libxslt-1.1.34-10.el9_4, libxslt-devel-1.1.34-10.el9_4
  • RHSA-2025:3107 Released 2025-03-24 · Red Hat rating Important
    libxslt security update
    • Red Hat Enterprise Linux AppStream (v. 9) libxslt-1.1.34-9.el9_5.1, libxslt-devel-1.1.34-9.el9_5.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    xmlsoft libxslt 1.1.43

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2024-36876 xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.Priority HIGH 67
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:7496
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:3615
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:3107
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:3619
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:3626
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:3625
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2025:3626
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:3625
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:3627
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2025:3624
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2025:3528
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:3389
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2025:3626
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:3625
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:3615
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:3619
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:3626
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:3625
Red Hat Enterprise Linux BaseOS E4S (v.8.4)Fixed RHSA-2025:3626
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:3625
Red Hat Enterprise Linux BaseOS EUS (v.8.8)Fixed RHSA-2025:3624
Red Hat Enterprise Linux BaseOS TUS (v.8.4)Fixed RHSA-2025:3626
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:3625
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:4098
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2025:4098
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2025:8303
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2025:4677
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2025:7702
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2025:4422
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2025:4731
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2025:4431
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2025:4427
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2025:9278
Not affected: 7 products
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-24855
  2. 2026-10-03 Alias added: GHSA-3cgj-v3m4-cgcq
  3. 2026-11-04 Fix available: RHSA-2025:4422 · Red Hat
  4. 2026-11-04 Fix available: RHSA-2025:7702 · Red Hat

References

Exploit 1

  • TI-2024-36876 xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes. CVSS 3.1HIGH 7.8
  • TI-2021-10955 Use after free in Google Chrome CVSS 3.1HIGH 8.8
  • TI-2019-08276 libxslt through 1.1.33 allows bypass of a protection mechanism because callers of… CVSS 3.1CRITICAL 9.8
  • TI-2016-03975 libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows… CVSS 3.1CRITICAL 9.8
  • TI-2016-03974 libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows… CVSS 3.1CRITICAL 9.8
  • TI-2016-03973 libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows… CVSS 3.1CRITICAL 9.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences