CVE-2025-10911

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
redhatCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
Debian logo
Debian Releases
Debian Product
Codename
libxslt
bullseye
vulnerable
trixie
postponed
bookworm
postponed
bullseye (security)
vulnerable
bookworm (security)
vulnerable
trixie (security)
vulnerable
forky
1.1.43-0.3
fixed
sid
1.1.43-0.3
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2025-10911
https://bugzilla.redhat.com/show_bug.cgi?id=2397838
https://gitlab.gnome.org/GNOME/libxslt/-/issues/144
https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77