Bug 2379228 (CVE-2025-7424) - CVE-2025-7424 libxslt: Type confusion in xmlNode.psvi between stylesheet and source nodes
Summary: CVE-2025-7424 libxslt: Type confusion in xmlNode.psvi between stylesheet and ...
Keywords:
Status: NEW
Alias: CVE-2025-7424
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2379262 2379263 2379264 2379265 2379266 2379267 2379268 2379269 2379270 2379271
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-07-10 08:56 UTC by OSIDB Bzimport
Modified: 2025-07-17 07:17 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-07-10 08:56:25 UTC
Type confusion in xmlNode.psvi between stylesheet and source nodes of libxslt. Due to sharing of the psvi field, data from the style-sheet context may be misinterpreted when used for source document nodes during XSLT transformations. As a result, parsing a crafted XSLT can corrupt memory or crash the application, and may allow remote code execution without authentication or user interaction, disrupting services that rely on libxslt.


Note You need to log in before you can comment on or make changes to this bug.