A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adoptopenjdk | — | Upgrade to the latest version of AdoptOpenJDK | Feb 24, 2026 | Feb 24, 2026 |
| Alma_linux | — | Upgrade python3-libxml2Upgrade libxml2-develUpgrade libxml2 | Aug 4, 2025 | Jul 31, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libxml2-pythonUpgrade libxml2-staticUpgrade libxml2-develUpgrade libxml2Upgrade libxml2-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libxml2-staticUpgrade python3-libxml2-debuginfoUpgrade python3-libxml2Upgrade libxml2-debuginfoUpgrade libxml2-debugsourceUpgrade libxml2Upgrade libxml2-devel | Sep 9, 2025 | Jul 10, 2025 |
| Apple Osx Libxml2 | — | Upgrade macOS to the latest version | Aug 8, 2025 | Aug 8, 2025 |
| Apple Safari | — | Uninstall Apple Safari on WindowsUpgrade to Apple Safari version 18.6 | Jul 31, 2025 | Jul 31, 2025 |
| Azul Zulu | — | Upgrade to Azul Zulu JDK 17 installer 17.63.12 (JDK 17.0.17.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 11 installer 11.85.12 (JDK 11.0.29.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 8 installer 8.91.0.12 (JDK 8u481-b01, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 21 installer 21.47.14 (JDK 21.0.9.0.101+1, quarterly CPU) (LTS stream)Upgrade to Azul Zulu JDK 25 installer 25.31.14 (JDK 25.0.1.0.101+1, quarterly CPU) (LTS stream) | Feb 25, 2026 | Jul 10, 2025 |
| Debian | — | No solution exists | Jul 14, 2025 | Jul 10, 2025 |
| Eclipseadoptium | — | — | Jun 26, 2026 | Jul 10, 2025 |
| Freebsd | — | Upgrade libxsltUpgrade linux-rl9-libxsltUpgrade linux-c7-libxslt | Jul 13, 2025 | Jul 12, 2025 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Feb 3, 2026 | Jul 10, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade libxml2-staticUpgrade libxml2-pythonUpgrade libxml2-develUpgrade python3-libxml2Upgrade libxml2 | Aug 1, 2025 | Jul 10, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Jul 10, 2025 |
| Redhat_linux | — | Upgrade libxml2Upgrade python3-libxml2Upgrade libxml2-debugsourceUpgrade libxml2-pythonUpgrade python3-libxml2-debuginfoUpgrade libxml2-develNo solution existsUpgrade libxml2-debuginfoUpgrade libxml2-static | Jul 11, 2025 | Jul 10, 2025 |
| Rocky_linux | — | Upgrade libxml2Upgrade python3-libxml2Upgrade python3-libxml2-debuginfoUpgrade libxml2-debugsourceUpgrade libxml2-develUpgrade libxml2-debuginfo | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade python3-libxml2Upgrade libxml2-develUpgrade libxml2-2Upgrade libxml2-toolsUpgrade python3-libxml2-pythonUpgrade python313-libxml2Upgrade python311-libxml2Upgrade libxml2-2-32bitUpgrade libxml2-docUpgrade libxml2-devel-32bitUpgrade python-libxml2 | Aug 14, 2025 | Aug 1, 2025 |
| Ubuntu | — | Upgrade python3-libxml2Upgrade python-libxml2 (Ubuntu Pro)Upgrade libxml2Upgrade libxml2 (Ubuntu Pro)Upgrade python3-libxml2 (Ubuntu Pro) | Nov 4, 2025 | Oct 30, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | Jul 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub