Xmlsoft libxslt up to 1.1.42 numbers.c use after free

Summaryinfo

A vulnerability was found in Xmlsoft libxslt up to 1.1.42. It has been rated as critical. Affected is the function xsltNumberFormatGetValue/xsltEvalXPathPredicate/xsltEvalXPathStringNs/xsltComputeSortResultInternal of the file numbers.c. The manipulation leads to use after free. This vulnerability is referenced as CVE-2025-24855. The attack can only be performed from a local environment. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Xmlsoft libxslt up to 1.1.42 and classified as critical. This issue affects the function xsltNumberFormatGetValue/xsltEvalXPathPredicate/xsltEvalXPathStringNs/xsltComputeSortResultInternal of the file numbers.c. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

The advisory is shared at gitlab.gnome.org. The identification of this vulnerability is CVE-2025-24855 since 01/26/2025. The exploitation is known to be difficult. An attack has to be approached locally. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 233281 (Debian dsa-5884 : libxslt1-dev - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.1.43 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (233281), EUVD (EUVD-2025-7659) and CERT Bund (WID-SEC-2025-1569). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• IBM WebSphere Service Registry and Repository
• Amazon Linux 2
• IBM InfoSphere Information Server
• Open Source OpenJDK
• Red Hat Enterprise Linux
• IBM Tivoli Netcool/OMNIbus
• Ubuntu Linux
• IBM WebSphere Application Server
• SUSE Linux
• Oracle Linux
• IBM Integration Bus
• IBM Rational Application Developer for WebSphere Software
• Hitachi Ops Center
• IGEL OS
• Hitachi Configuration Manager
• IBM QRadar SIEM
• Dell Data Protection Advisor
• IBM Storwize
• IBM Business Automation Workflow
• IBM FlashSystem
• IBM Rational Business Developer
• IBM Tivoli Key Lifecycle Manager
• SUSE openSUSE
• IBM License Metric Tool
• IBM App Connect Enterprise
• Xerox FreeFlow Print Server
• HCL BigFix
• Azul Zulu
• IBM TXSeries
• IBM MQ
• IBM SPSS
• Hitachi Command Suite
• Dell Avamar
• IBM Tivoli Monitoring
• Oracle Java SE
• Oracle GraalVM
• Amazon Corretto
• IBM Semeru Runtime
• IBM Java
• IBM Installation Manager
• IBM Tivoli Business Service Manager
• IBM Tivoli Network Manager
• Absolute Secure Access
• IBM Sterling Connect:Direct
• IBM DataPower Gateway
• Dell NetWorker
• RealObjects PDFreactor
• IBM SAN Volume Controller

Productinfo

Vendor

• Xmlsoft

Name

• libxslt

Version

• 1.1.0
• 1.1.1
• 1.1.2
• 1.1.3
• 1.1.4
• 1.1.5
• 1.1.6
• 1.1.7
• 1.1.8
• 1.1.9
• 1.1.10
• 1.1.11
• 1.1.12
• 1.1.13
• 1.1.14
• 1.1.15
• 1.1.16
• 1.1.17
• 1.1.18
• 1.1.19
• 1.1.20
• 1.1.21
• 1.1.22
• 1.1.23
• 1.1.24
• 1.1.25
• 1.1.26
• 1.1.27
• 1.1.28
• 1.1.29
• 1.1.30
• 1.1.31
• 1.1.32
• 1.1.33
• 1.1.34
• 1.1.35
• 1.1.36
• 1.1.37
• 1.1.38
• 1.1.39
• 1.1.40
• 1.1.41
• 1.1.42

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion