CVE-2025-10911: libxslt Use-After-Free Vulnerability

CVE-2025-10911 Overview

CVE-2025-10911 is a use-after-free vulnerability in libxslt, the widely deployed XSLT processing library maintained by the GNOME Project. The flaw occurs while parsing XSL nodes, where the library dereferences expired pointers and causes the consuming application to crash. The weakness is classified under [CWE-825: Expired Pointer Dereference].

Exploitation requires a local attack vector and user interaction, typically by having a victim process a malicious XSLT stylesheet. The impact is limited to availability; no confidentiality or integrity loss occurs. Because libxslt is embedded in browsers, PHP, Python bindings, and numerous document processing pipelines, the vulnerability has broad exposure across Linux distributions.

Critical Impact
Processing an attacker-supplied XSL stylesheet triggers a use-after-free that crashes the host application, producing a denial-of-service condition in any tool linking against vulnerable versions of libxslt.

Affected Products

GNOME libxslt (upstream library, per GNOME Issue #144)
Red Hat Enterprise Linux packages shipping libxslt, tracked in Red Hat CVE-2025-10911
Downstream applications that link libxslt for XSLT transformation (e.g., xsltproc, language bindings)

Discovery Timeline

2025-09-25 - CVE-2025-10911 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2025-10911

Vulnerability Analysis

The defect lives in the XSL node parsing path of libxslt. During parsing, the code retains references to node objects whose backing memory has already been released. When the parser subsequently dereferences those pointers, it operates on freed memory. This produces undefined behavior and, in observed cases, an application crash.

The vulnerability is scoped to local access with required user interaction, aligning with a workflow where a victim opens or transforms a crafted XSLT document. Only availability is affected: the process aborts, terminating in-flight XSLT processing and any coupled workload. Confidentiality and integrity are not impacted, and no privilege change is required to trigger the fault.

The EPSS probability at the time of writing is 0.173%, indicating low near-term exploitation likelihood. However, the ubiquity of libxslt across server-side XML pipelines makes patch coverage a priority for platforms where XSLT is exposed to untrusted content.

Root Cause

The root cause is lifetime mismanagement of XSL node pointers during stylesheet parsing. Node structures are freed while other parser state still holds references to them, and no reference counting or invalidation guards the subsequent access. The upstream fix is tracked in GNOME Merge Request #77 and correlates with Red Hat Bug Report #2397838.

Attack Vector

An attacker delivers a malicious XSLT stylesheet to a victim who processes it with a libxslt-backed tool such as xsltproc, a scripting language binding, or an application that transforms XML. When the parser walks the crafted node structure, the expired pointer is dereferenced and the process terminates.

The vulnerability is not remotely exploitable without user interaction, and no arbitrary code execution has been reported. See the security advisory linked above for technical details.

Detection Methods for CVE-2025-10911

Indicators of Compromise

Unexpected SIGSEGV or SIGABRT termination of processes that invoke libxslt, including xsltproc, PHP-FPM, or Python workers using lxml.
Core dumps whose stack traces reference XSL node parsing functions inside libxslt.
Repeated ingestion or upload of XSLT stylesheets from untrusted sources followed by service restarts.

Detection Strategies

Inventory installed libxslt package versions across Linux fleet and compare against fixed builds enumerated in the Red Hat advisories such as RHSA-2026:11015 and RHSA-2026:33313.
Enable core dump capture on systems that parse XSLT and inspect crash frames for libxslt symbols.
Instrument affected services with AddressSanitizer or Valgrind in test environments to confirm the use-after-free path is closed.

Monitoring Recommendations

Alert on abnormal termination rates for services that process XML or XSLT, correlating with recent stylesheet uploads.
Track syslog and journald for libxslt-linked processes exiting with non-zero status codes.
Monitor file upload gateways for .xsl or .xslt submissions from untrusted principals and route them through a sandboxed parser.

How to Mitigate CVE-2025-10911

Immediate Actions Required

Apply vendor updates for libxslt on all systems, prioritizing servers that transform externally supplied XML or XSLT.
Restart long-running services such as web servers, application servers, and job runners after upgrading the shared library so the patched code is loaded.
Restrict user-supplied XSLT processing to sandboxed workers with resource limits until patching is verified.

Patch Information

Red Hat has published multiple errata addressing CVE-2025-10911, including RHSA-2026:11015, RHSA-2026:26355, RHSA-2026:28243, RHSA-2026:28584, RHSA-2026:29807, RHSA-2026:33313, RHSA-2026:44481, and RHSA-2026:58981. Upstream code changes are merged in GNOME Merge Request #77.

Workarounds

Block or reject XSLT documents from untrusted sources at application ingress until the patched library is deployed.
Disable XSLT processing features in applications that expose them optionally (for example, PHP's XSLTProcessor where not required).
Run XSLT transformations under a restricted user account with process limits so a crash cannot cascade to other services.

bash

# Example: verify the installed libxslt version on RHEL-based hosts
rpm -q libxslt

# Update to the patched build
sudo dnf update libxslt

# Confirm no vulnerable version remains loaded by long-running services
sudo lsof +c 0 | grep -i libxslt