Fluid Attacks Database

Description

A flaw was found in the libxslt library. The same memory field, psvi, is used for both stylesheet and input data, which can lead to type confusion during XML transformations. This vulnerability allows an attacker to crash the application or corrupt memory. In some cases, it may lead to denial of service or unexpected behavior.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	libxslt	=1.1.34-4 \|\| =1.1.34-4+deb11u1 \|\| =1.1.34-4+deb11u2 \|\| >=0 <1.1.34-4+deb11u3	1.1.34-4+deb11u3
debian 12	libxslt	=1.1.35-1 \|\| =1.1.35-1+deb12u1 \|\| >=0 <1.1.35-1+deb12u2	1.1.35-1+deb12u2
debian 13	libxslt	=1.1.35-1.2 \|\| >=0 <1.1.35-1.2+deb13u1	1.1.35-1.2+deb13u1
debian 14	libxslt	=1.1.35-1.2 \|\| >=0 <1.1.35-2	1.1.35-2
rpm rhel10	libxslt	<0:1.1.39-8.el10_0	0:1.1.39-8.el10_0
rpm rhel6	libxslt	-	-
rpm rhel10	libxml2	<0:2.12.5-8.el10_0	0:2.12.5-8.el10_0

Aliases

1. CVE-2025-74242. NVD-2025-74243. OSV-DEBIAN-2025-74244. OSV-2025-74245. SECURITY-TRACKER-CVE-2025-7424

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.