Type Confusion Vulnerability in libxslt for Red Hat Products
CVE-2025-11731

3.1LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 8
Vendor
CVE Published:
14 October 2025

What is CVE-2025-11731?

A flaw exists in the exsltFuncResultComp() function of libxslt, responsible for processing EXSLT func:result elements during the parsing of stylesheets. The improper handling of types can lead to the misinterpretation of an XML document node as a standard XML element node. This type confusion could result in unexpected memory reads, potentially causing application instability, crashes, or denial of service. While the exploitation of this flaw is challenging, its implications could severely impact applications relying on libxslt for XML processing.

References

https://access.redhat.com/security/cve/CVE-2025-11731
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2403688
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-11731 : Type Confusion Vulnerability in libxslt for Red Hat Products