# CVE-2025-7425: GNOME libxslt heap use-after-free in attribute management

Source: https://junglewise.ai/threats/cve-2025-7425-gnome-libxslt-heap-use-after-free-in-attribute-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-10. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2025-7425 · Severity: high · CVSS 7.8 · Published 2025-07-10

A memory management flaw was found in libxslt, a library used by many applications to process XML data. An attacker could exploit this vulnerability to cause a system crash or potentially execute unauthorized actions by corrupting the system's memory. This could lead to service outages or a compromise of system integrity in environments that process untrusted XML documents.

Technologies: [Gnome Libxslt](https://junglewise.ai/threats/technologies/libxslt), [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 7](https://junglewise.ai/threats/technologies/enterprise-linux-7), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Gnome](https://junglewise.ai/threats/vendors/gnome), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-7425 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7425 being exploited in the wild.

**How severe is CVE-2025-7425?** High severity, with a CVSS score of 7.8, published 10 July 2025.

**Which products and versions are affected?** Gnome Libxslt < 1.1.39-8.el10_0, 1.1.39-8.el10_0; Red Hat Enterprise Linux 10 < 2.12.5-8.el10_0; Red Hat Enterprise Linux 7 < 2.9.1-6.el7_9.12; Red Hat Enterprise Linux 8 Affected; and 1 more.

**Is there a fix for CVE-2025-7425?** A patch was published on 2025-07-31: Red Hat released security updates (RHSA-2025:12447) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-7425 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-7425?** Check whether you run Gnome Libxslt, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in libxslt due to improper modification of attribute type, atype, and flags within the xmlAttrPtr structure. When XSLT functions (such as the key() process) generate tree fragments, this corruption prevents the correct cleanup of ID attributes. Consequently, the library may attempt to access memory that has already been freed, leading to a crash or allowing an attacker to trigger heap corruption. The vulnerability is typically reachable when the library processes specially crafted XSLT stylesheets or XML input. Patches have been released by GNOME and various Linux distributions including Red Hat and Debian.

## Affected products

- GNOME libxslt < 1.1.39-8.el10_0
- GNOME libxml2 < 2.15.2
- Red Hat Red Hat Enterprise Linux 7 < 2.9.1-6.el7_9.12
- Red Hat Red Hat Enterprise Linux 8 Affected
- Red Hat Red Hat Enterprise Linux 9 < 2.9.13-11.el9_6
- Red Hat Red Hat Enterprise Linux 10 < 2.12.5-8.el10_0

## Timeline

- 2025-07-10: disclosed: CVE published date
- 2025-07-31: patched: Red Hat released security updates (RHSA-2025:12447)

## References

- [https://gitlab.gnome.org/GNOME/libxml2/](https://gitlab.gnome.org/GNOME/libxml2/)
- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/errata/RHBA-2025:12345](https://access.redhat.com/errata/RHBA-2025:12345)
- [https://access.redhat.com/errata/RHSA-2025:12447](https://access.redhat.com/errata/RHSA-2025:12447)
- [https://access.redhat.com/errata/RHSA-2025:12450](https://access.redhat.com/errata/RHSA-2025:12450)
- [https://access.redhat.com/errata/RHSA-2025:13267](https://access.redhat.com/errata/RHSA-2025:13267)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)