CVE-2025-11731 — Type Confusion in Libxslt
Severity
3.1LOWNVD
EPSS
0.1%
top 77.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 14
Description
A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:LExploitability: 1.6 | Impact: 1.4
Affected Packages6 packages
🔴Vulnerability Details
2GHSA▶
GHSA-9f23-58rv-2hx4: A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT elements during stylesheet parsing↗2025-10-14
OSV▶
CVE-2025-11731: A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT elements during stylesheet parsing↗2025-10-14