CVE-2025-24855: numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never...
7.8
CVSS
Description
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
Classification
CVE ID: CVE-2025-24855
CVSS Base Severity: HIGH
CVSS Base Score: 7.8
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Problem Types
CWE-416 Use After FreeAffected Products
Vendor: xmlsoft
Product: libxslt
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.01% (probability of being exploited)
EPSS Percentile: 0.21% (scored less or equal to compared to others)
EPSS Date: 2025-04-11 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-24855https://gitlab.gnome.org/GNOME/libxslt/-/issues/128