CVE-2025-24855

What it actually does

Use-after-free in libxslt numbers.c during nested XPath evaluations where an XPath context node is modified in xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs or xsltComputeSortResultInternal but never restored, allowing memory corruption.

Why it matters to the business

Applications that process untrusted XML or XSLT documents with libxslt may crash or allow arbitrary code execution, potentially disrupting document transformation workflows and requiring emergency updates across dependent systems.

How an attack unfolds

An attacker supplies a malicious XSLT stylesheet or XML input that triggers nested XPath evaluations involving number formatting or sorting; the library fails to restore the context node, resulting in a dangling pointer that can be leveraged to corrupt memory and execute attacker-controlled code.

How to fix it

Upgrade libxslt to the commit 71be7a32637760d769b193d95e0c745ecb86b679 or later release containing the fix; rebuild and redeploy all dependent applications; validate that no older versions remain in build pipelines or container images.

How to confirm the fix worked

Confirm the installed libxslt version or git commit hash matches or exceeds 71be7a32637760d769b193d95e0c745ecb86b679; run regression tests exercising nested XPath number formatting and sorting; scan dependency manifests for the vulnerable version string.

Typical attack path

1. Identify application endpoints or workflows accepting XSLT or XML input processed by libxslt
2. Craft nested XPath expressions targeting xsltNumberFormatGetValue or sort routines
3. Trigger use-after-free via modified context node during evaluation
4. Leverage resulting memory corruption for code execution or denial of service

How to detect it

Review application logs for crashes or abnormal behavior during XSLT processing; inspect core dumps or memory analysis for use-after-free patterns in XPath evaluation functions; search package managers and build logs for references to vulnerable libxslt versions prior to the fix commit.

What your security team should do

• Immediately inventory all systems and containers using libxslt and prioritize upgrade to the fixed commit
• Add libxslt version checks to CI/CD pipelines and container scanning tools
• Monitor for any new exploit code given the age of the disclosure and low but rising EPSS
• Review applications that accept user-supplied XSLT for additional input sanitization