CVE-2025-7424

What it actually does

Type confusion in libxslt XML transformations caused by reuse of the psvi memory field for both stylesheet and input data, enabling memory corruption or crashes.

Why it matters to the business

Applications using the library may crash or exhibit unexpected behavior, resulting in denial of service and potential operational disruption; the issue affects a widely used XML library with moderate exploitability scores.

How an attack unfolds

An attacker crafts malicious XML content that triggers reuse of the shared psvi field during stylesheet and input processing, leading to type confusion that corrupts memory or terminates the application.

How to fix it

Upgrade affected packages to the fixed versions provided by vendors, such as linux-lts (Alpaquita:stream) to 6.6.58-r0 or later; rebuild and redeploy dependent applications after the update.

How to confirm the fix worked

Verify installed libxslt version against the fixed release, re-run unit tests with crafted XML inputs that previously triggered the flaw, and confirm absence of crashes or corruption under load.

Typical attack path

1. Identify an application that processes untrusted XML via libxslt
2. Craft XML input that collides stylesheet and data structures on the psvi field
3. Deliver the XML to the target transformation routine
4. Trigger memory corruption or application crash

How to detect it

Review application and system logs for unexpected crashes or segmentation faults in processes linked to libxslt during XML handling; correlate with inbound XML traffic that precedes failures.

What your security team should do

• Prioritize upgrade of libxslt to the fixed version in all environments within the next maintenance window
• Monitor EPSS trend and reassess exploit maturity as new information emerges
• Implement input validation and sandboxing for XML processing workflows until patches are applied