Is CVE-2025-11731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-11731 being exploited in the wild.

How severe is CVE-2025-11731?

Low severity, with a CVSS score of 3.1, published 14 October 2025.

Is there a fix for CVE-2025-11731?

A patch was published on 2026-04-27: Red Hat released security updates for Hardened Images. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-11731 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-11731?

Check whether you run Gnome Libxslt, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-11731: GNOME libxslt type confusion in exsltFuncResultComp

CVE-2025-11731 · Severity: low · CVSS 3.1 · Published 2025-10-14

A vulnerability was found in libxslt, a widely used library for processing XML documents. An attacker could provide a specially crafted stylesheet that causes applications using this library to crash or become unstable. While the risk of data theft is low, this flaw can lead to a denial of service, impacting the availability of systems that process untrusted XML content.

Technologies: Gnome Libxslt, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Gnome, Red Hat.

Quick answers

Is CVE-2025-11731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-11731 being exploited in the wild.
How severe is CVE-2025-11731?: Low severity, with a CVSS score of 3.1, published 14 October 2025.
Which products and versions are affected?: Gnome Libxslt < 1.1.44.
Is there a fix for CVE-2025-11731?: A patch was published on 2026-04-27: Red Hat released security updates for Hardened Images. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-11731 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-11731?: Check whether you run Gnome Libxslt, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A type confusion vulnerability exists in the exsltFuncResultComp() function within libxslt's EXSLT extension. When the function handles a <func:result> element, it traverses the node hierarchy to find a parent <func:function> element. If no such ancestor is found, the loop incorrectly continues until it reaches the XML document node (xmlDoc). Because xmlDoc lacks a namespace (ns) property, the function misinterprets integer fields (compression and standalone) as a namespace pointer. This results in an out-of-bounds memory read and a potential segmentation fault. The vulnerability can be triggered remotely if an application processes an untrusted XSL stylesheet. A fix is available in libxslt version 1.1.44 and later.

Affected products

GNOME libxslt < 1.1.44
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat OpenShift Container Platform 4

Timeline

2025-10-14: disclosed: Vulnerability reported by Google Big Sleep and tracked by Red Hat.
2025-10-14: advisory: Initial CVE publication.
2026-04-27: patched: Red Hat released security updates for Hardened Images.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.