Is CVE-2025-7424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7424 being exploited in the wild.

How severe is CVE-2025-7424?

High severity, with a CVSS score of 7.5, published 10 July 2025.

Is there a fix for CVE-2025-7424?

A patch was published on 2025-07-31: Red Hat released bug fix advisory RHBA-2025:12345 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-7424 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-7424?

Check whether you run Gnome Libxslt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7424: GNOME libxslt type confusion in xmlNode psvi field

CVE-2025-7424 · Severity: high · CVSS 7.5 · Published 2025-07-10

A vulnerability has been identified in libxslt, a widely used library for processing XML data. The flaw allows an attacker to cause applications using this library to crash or behave unpredictably by providing specially crafted XML files. This could lead to a denial of service, impacting the availability of services that rely on XML transformations.

Technologies: Gnome Libxslt. Vendors: Gnome.

Quick answers

Is CVE-2025-7424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7424 being exploited in the wild.
How severe is CVE-2025-7424?: High severity, with a CVSS score of 7.5, published 10 July 2025.
Which products and versions are affected?: Gnome Libxslt < 1.1.44.
Is there a fix for CVE-2025-7424?: A patch was published on 2025-07-31: Red Hat released bug fix advisory RHBA-2025:12345 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-7424 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-7424?: Check whether you run Gnome Libxslt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A type confusion vulnerability (CWE-843) exists in libxslt due to the reuse of the 'psvi' memory field in the xmlNode structure for both stylesheet and input data. During XML transformations, this overlap allows for incompatible type access. An unauthenticated remote attacker can exploit this by providing malicious XML input, leading to memory corruption or a denial of service (application crash). The issue is addressed in libxslt version 1.1.44 and various vendor-specific patches such as Red Hat Enterprise Linux 10.

Affected products

GNOME libxslt < 1.1.44
Red Hat Red Hat Enterprise Linux 10 libxslt < 1.1.39-8.el10_0

Timeline

2025-07-10: disclosed
2025-07-10: advisory
2025-07-31: patched: Red Hat released bug fix advisory RHBA-2025:12345

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.