CVE-2025-7424CWE-843

CVE-2025-7424

High · published July 10, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
70.2
In the wild
Unconfirmed
What it is

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01301 · 70.2th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-07-10T18:15Z
Affected products (7)
ProductVersionsFixed in
xmlsoft/libxsltall versions—
redhat/openshift_container_platformall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (13)
EPSS history
Timeline
  • 10 JUL 14:05Z
    Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes
    cvelistv5