CVE-2025-7424

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

Libxslt is the XSLT C library developed for the GNOME project

Security Fix(es):

A vulnerability classified as problematic was found in libxslt (the affected version is unknown).The manipulation of the argument psvi with an unknown input leads to a unknown weakness. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.As an impact it is known to affect integrity, and availability.There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2025-7424)

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

• CVE-2025-7424: fix type confusion in xsltDocumentFunctionLoadDocument

Heap use after free (UAF) leads to Denial of service (DoS). (CVE-2025-49794) Null pointer dereference leads to Denial of service (DoS). (CVE-2025-49795) Type confusion leads to Denial of service (DoS). (CVE-2025-49796) Integer Overflow Leading to Buffer Overflow in xmlBuildQName(). (CVE-2025-6021) Stack-based Buffer Overflow in xmllint Shell. (CVE-2025-6170) Type confusion in xmlNode.psvi between stylesheet and source nodes. (CVE-2025-7424) Heap-use-after-free in xmlFreeID caused by atype corruption. (CVE-2025-7425)

These are all security issues fixed in the libexslt0-1.1.43-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-lxml-doc-6.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2025-7424 in the rootio-libxslt package for Root:Debian:12. Multiple fixed versions available.

This update for libxslt fixes the following issues:

• CVE-2025-7424: Fixed type confusion in xmlNode.psvi between stylesheet and source nodes (bsc#1246360)

This update for libxslt fixes the following issues:

• CVE-2025-7424: Type confusion in xmlNode.psvi between stylesheet and source nodes [bsc#1246360]

Ivan Fratric discovered that Libxslt was vulnerable to type confusion when performing XML transformations. An attacker could possibly use this issue to cause Libxslt to crash or corrupt memory, causing a denial of service or undefined behavior.