Junglewise Threat Intelligence

CVE-2025-10911: GNOME libxslt use-after-free in XSL node parsing

CVE-2025-10911 · Severity: medium · CVSS 5.5 · Published 2025-09-25

Technologies: Gnome Libxslt. Vendors: Gnome.

Executive brief

libxslt is a software library used to transform XML documents into other formats like HTML or plain text. A security flaw was found where processing a specially crafted stylesheet could cause the application to crash or behave unpredictably. This could lead to a denial-of-service, impacting the availability of services that rely on this library for document processing.

Technical details

A use-after-free vulnerability exists in libxslt due to the way Result Value Trees (RVTs) are managed during XSLT transformations. When global variables are evaluated, they are stored as RVTs in a linked list using the 'prev' and 'next' pointers of the xmlDocPtr structure. If an xsl:key expression uses axes like 'preceding::', it may traverse these pointers into a different RVT, causing nodes from one RVT to be stored in the key table of another. During cleanup, if the RVT containing the original nodes is freed before the RVT holding the reference in its key table, a use-after-free occurs when the second RVT attempts to access those expired pointers. This issue can be triggered by a local attacker providing a malicious XSL stylesheet and XML file, resulting in a denial-of-service (application crash).

Affected products

  • GNOME libxslt Prior to 1.1.45-0.1.hum1 (Red Hat Hardened Images) / 1.1.32-6.4.el8_10 (RHEL 8)

Timeline

  • 2025-09-24: disclosed: Initial report in Red Hat Bugzilla
  • 2025-09-25: advisory: NVD publication date
  • 2026-04-27: patched: Red Hat Hardened Images update released (RHSA-2026:11015)
  • 2026-06-16: patched: Red Hat Enterprise Linux 8 update released (RHSA-2026:26355)

References

Related threats