Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Summary

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.

Timeline

1. Jul 10, 2025, 1:53 PM UTCCVE published
2. Jul 10, 2025, 3:21 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: total

3. Oct 15, 2026, 1:02 AM UTCRecord last updated

Affected versions

• libxml2

  fixed in 2.15.2

• libxslt

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• libxml2

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

• web-terminal/web-terminal-rhel9-operator

  Version range not reported

• web-terminal/web-terminal-tooling-rhel9

  Version range not reported

• web-terminal/web-terminal-tooling-rhel9

  Version range not reported

• openshift-serverless-1/logic-data-index-ephemeral-rhel8

  Version range not reported

• openshift-serverless-1/logic-data-index-postgresql-rhel8

  Version range not reported

• openshift-serverless-1/logic-db-migrator-tool-rhel8

  Version range not reported

• openshift-serverless-1/logic-jobs-service-ephemeral-rhel8

  Version range not reported

• openshift-serverless-1/logic-jobs-service-postgresql-rhel8

  Version range not reported

• openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8

  Version range not reported

• openshift-serverless-1/logic-management-console-rhel8

  Version range not reported

• openshift-serverless-1/logic-operator-bundle

  Version range not reported

• openshift-serverless-1/logic-rhel8-operator

  Version range not reported

• openshift-serverless-1/logic-swf-builder-rhel8

  Version range not reported

• openshift-serverless-1/logic-swf-devmode-rhel8

  Version range not reported

• cert-manager/jetstack-cert-manager-rhel9

  Version range not reported

• compliance/openshift-compliance-must-gather-rhel8

  Version range not reported

• compliance/openshift-compliance-openscap-rhel8

  Version range not reported

• compliance/openshift-compliance-rhel8-operator

  Version range not reported

• compliance/openshift-file-integrity-rhel8-operator

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• libxml2-main

  Version range not reported

• insights-proxy/insights-proxy-container-rhel9

  Version range not reported

• rhosdt/jaeger-agent-rhel8

  Version range not reported

• rhosdt/jaeger-all-in-one-rhel8

  Version range not reported

• rhosdt/jaeger-collector-rhel8

  Version range not reported

• rhosdt/jaeger-es-index-cleaner-rhel8

  Version range not reported

• rhosdt/jaeger-es-rollover-rhel8

  Version range not reported

• rhosdt/jaeger-ingester-rhel8

  Version range not reported

• rhosdt/jaeger-operator-bundle

  Version range not reported

• rhosdt/jaeger-query-rhel8

  Version range not reported

• rhosdt/jaeger-rhel8-operator

  Version range not reported

• libxslt

  Version range not reported

• javaBitnami

  fixed in 1.8.0; From 1.9.0 · fixed in 8.0.481

• java-minBitnami

  fixed in 1.8.0; From 1.9.0 · fixed in 8.0.481

• jreBitnami

  fixed in 1.8.0; From 1.9.0 · fixed in 8.0.481

References 25