CVE-2025-7425 Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr
Attackers can trigger heap corruption and potential code execution via crafted XSLT processing in the libxslt library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-7425?
CVE-2025-7425 is a high-severity use after free vulnerability in GNOME Compliance Operator 1, published on 10 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
Weakness: CWE-416
Which versions are affected by CVE-2025-7425?
3 open source packages ship an affected version, including java, java-min and jre.
| Package | Affected | Fixed in |
|---|---|---|
java Bitnami | All versions | 1.8.0, 8.0.481 |
java-min Bitnami | All versions | 1.8.0, 8.0.481 |
jre Bitnami | All versions | 1.8.0, 8.0.481 |
Linux distribution packages (37)
libxml2 AlmaLinux:8 | All versions | 2.9.7-21.el8_10.2 |
libxml2-devel AlmaLinux:8 | All versions | 2.9.7-21.el8_10.2 |
python3-libxml2 AlmaLinux:8 | All versions | 2.9.7-21.el8_10.2 |
libxml2 AlmaLinux:9 | All versions | 2.9.13-11.el9_6 |
libxml2-devel AlmaLinux:9 | All versions | 2.9.13-11.el9_6 |
python3-libxml2 AlmaLinux:9 | All versions | 2.9.13-11.el9_6 |
libxml2-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.9.7-21.el8_10.2 |
libxml2-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:2.9.7-21.el8_10.2 |
libxml2-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:2.9.7-21.el8_10.2 |
python3-libxml2-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:2.9.7-21.el8_10.2 |
libxml2 Red Hat:enterprise_linux:8::baseos | All versions | 0:2.9.7-21.el8_10.2 |
libxml2-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.9.7-21.el8_10.2 |
libxml2-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:2.9.7-21.el8_10.2 |
python3-libxml2 Red Hat:enterprise_linux:8::baseos | All versions | 0:2.9.7-21.el8_10.2 |
python3-libxml2-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.9.7-21.el8_10.2 |
libxml2-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2.9.13-11.el9_6 |
libxml2-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:2.9.13-11.el9_6 |
libxml2-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:2.9.13-11.el9_6 |
python3-libxml2-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:2.9.13-11.el9_6 |
libxml2 Red Hat:enterprise_linux:9::baseos | All versions | 0:2.9.13-11.el9_6 |
libxml2-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:2.9.13-11.el9_6 |
libxml2-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:2.9.13-11.el9_6 |
python3-libxml2 Red Hat:enterprise_linux:9::baseos | All versions | 0:2.9.13-11.el9_6 |
python3-libxml2-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:2.9.13-11.el9_6 |
libxml2-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.9.7-9.el8_2.4 |
libxml2-debugsource Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.9.7-9.el8_2.4 |
libxml2-devel Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.9.7-9.el8_2.4 |
python3-libxml2-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:2.9.7-9.el8_2.4 |
libxml2 Red Hat:rhel_aus:8.2::baseos | All versions | 0:2.9.7-9.el8_2.4 |
libxml2-debuginfo Red Hat:rhel_aus:8.2::baseos | All versions | 0:2.9.7-9.el8_2.4 |
libxml2-debugsource Red Hat:rhel_aus:8.2::baseos | All versions | 0:2.9.7-9.el8_2.4 |
python3-libxml2 Red Hat:rhel_aus:8.2::baseos | All versions | 0:2.9.7-9.el8_2.4 |
python3-libxml2-debuginfo Red Hat:rhel_aus:8.2::baseos | All versions | 0:2.9.7-9.el8_2.4 |
libxml2-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 0:2.9.7-9.el8_4.7 |
libxml2-debugsource Red Hat:rhel_aus:8.4::appstream | All versions | 0:2.9.7-9.el8_4.7 |
libxml2-devel Red Hat:rhel_aus:8.4::appstream | All versions | 0:2.9.7-9.el8_4.7 |
python3-libxml2-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 0:2.9.7-9.el8_4.7 |
How do I fix CVE-2025-7425?
Upgrade java to a fixed version for your release line: 1.8.0 or 8.0.481.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-7425 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-7425 exists.
Sources
Also known as ALSA-2025:12447, ALSA-2025:12450, AZL-65409, AZL-73183, AZL-75182, BELL-CVE-2025-7425 and 40 more.