CVE-2025-10911

EUVD-2025-31128
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
redhatCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Debian logo
Debian Releases
Debian Product
Codename
libxslt
bookworm
postponed
bookworm (security)
vulnerable
bullseye
vulnerable
bullseye (security)
vulnerable
forky
1.1.43-0.3
fixed
sid
1.1.43-0.3
fixed
trixie
postponed
trixie (security)
vulnerable
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2025-10911
https://bugzilla.redhat.com/show_bug.cgi?id=2397838
https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77