libxslt: use-after-free in libxslt key() function leading to heap corruption (CVE-2025-7425) #shorts

Summary

Today we’re talking about CVE-2025-7425, a critical memory corruption vulnerability in libxslt, the XSLT processing library used by libxml2. This flaw can lead to heap corruption or crashes when processing certain XSLT functions, and it has been addressed by major Linux distributors in July 2025.

Product details

libxslt is the XSLT engine that transforms XML documents according to stylesheet rules. It ships as part of libxml2 and is widely used on Oracle Linux, SUSE Linux Enterprise Server, Red Hat Enterprise Linux, and related platforms such as OpenShift Container Platform. Affected versions include libxslt releases before the July 2025 security updates.

Vulnerability type summary

This issue is classified as a use-after-free that can trigger heap corruption. In some reports it’s also described as a buffer overflow in the attribute-type handler of the key() function. Either way, improper memory management lets an attacker manipulate freed or overwritten data.

Details of the vulnerability

The problem lies in how libxslt updates internal attribute metadata—specifically the atype and flags fields—when constructing tree fragments for functions like key(). Under certain conditions, ID attributes are not cleaned up correctly, leaving dangling pointers. Subsequent operations can walk those pointers back into freed heap memory. The result can be a crash or crafted heap corruption, potentially enabling further exploitation. The flaw was published on July 10, 2025, and vendors like Oracle, SUSE and Red Hat issued patches by the end of July.

Conclusion

If you run any service or application that relies on libxslt or libxml2, you should install the vendor security updates immediately. Oracle Linux 8, SUSE Enterprise Linux, Red Hat Enterprise Linux 8 and 9, and associated container platforms all provide patched packages. Applying these updates will close the use-after-free hole and protect your systems from crashes or malicious heap tampering.

Watch the full video on YouTube: CVE-2025-7425

Remediation and exploitation details

This chain involves the following actors

  • Attacker: Crafts and delivers malicious transformation to exploit the vulnerability
  • System Administrator: Applies patches and monitors for updates

This following systems are involved

  • libxslt (Library that performs Extensible Stylesheet Language Transformations): Contains the vulnerable key() function
  • Application using libxml2 bindings (Host program that calls libxslt to process XSLT documents): Exposes the key() entry point to user-supplied stylesheets

Attack entry point

  • User-supplied XSLT document: Inputs a stylesheet with specially crafted key() definitions
  • key() function in libxslt: Performs index lookups and tree fragment creation that trigger the flaw

Remediation actions

System Administrator
Install the vendor security update
Oracle Linux 8
System Administrator
Apply patched libxslt packages
SUSE Linux Enterprise
System Administrator
Update libxml2 and libxslt to fixed release
Red Hat Enterprise Linux

Exploitation actions

Use of key() to generate tree fragments containing ID attributes

Attacker
Create a stylesheet defining a key that matches elements with identifier attributes
User-supplied XSLT document
Examples:
  • <xsl:key name="k" match="//item" use="@id"/>

Trigger creation of multiple tree fragments without proper cleanup

Attacker
Invoke the key() function repeatedly on the same tree nodes
libxslt
Examples:
  • call key('k','123') in a loop over matching nodes

Corrupt internal memory management structures during fragment creation

libxslt
Modify internal attribute type and flags when building the index
libxslt
Examples:
  • atype and flags fields overwritten in xml attribute object

Use-after-free access to attribute objects

libxslt
Free tree fragments containing ID attributes but leave pointers active
libxslt
Examples:
  • Cleanup routine skips id attribute removal, pointer remains

Heap corruption leading to crash or potential arbitrary memory overwrite

Attacker
Force the application to reuse freed memory by additional key() lookups
libxslt
Examples:
  • Repeated stylesheet execution until process aborts

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-7425
Description
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
Provider
redhat
CWE / problem types
Use After Free
Affected Software Versions
Red Hat:Red Hat Enterprise Linux 8:[{'version': '0:2.9.7-21.el8_10.2', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 8:[{'version': '0:2.9.7-21.el8_10.2', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9:[{'version': '0:2.9.13-11.el9_6', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9:[{'version': '0:2.9.13-11.el9_6', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 10:None,Red Hat:Red Hat Enterprise Linux 6:None,Red Hat:Red Hat Enterprise Linux 7:None,Red Hat:Red Hat OpenShift Container Platform 4:None
Date Published
2025-07-10T13:53:37.295Z
Last Updated
2025-07-31T16:32:11.491Z