CVE-2025-7425

What it actually does

Use-after-free in libxslt memory management for ID attributes after XSLT key() functions produce tree fragments, enabling heap corruption or crashes.

Why it matters to the business

Potential local code execution or denial of service on systems processing untrusted XSLT stylesheets, with upgrade required for affected linux-lts packages.

How an attack unfolds

An attacker supplies a crafted XSLT stylesheet containing key() functions that trigger internal attribute flag corruption; during cleanup of resulting tree fragments the freed ID structures are accessed, leading to heap corruption that may be leveraged for local exploitation.

How to fix it

Upgrade linux-lts (Alpaquita:stream) to version 6.6.58-r0 or later; rebuild and redeploy any applications statically linking the vulnerable libxslt.

How to confirm the fix worked

Confirm package version is at or above the fixed release, run regression tests with XSLT stylesheets that exercise key() functions, and verify absence of crashes or sanitizer reports on crafted inputs.

Typical attack path

1. Deliver malicious XSLT input to a libxslt consumer on the target system
2. Trigger XSLT processing that invokes key() or similar functions producing tree fragments
3. Cause attribute type/flag corruption during internal memory handling
4. Access freed ID attribute memory during cleanup to induce heap corruption or crash

How to detect it

Monitor for crashes or sanitizer violations in libxslt-using processes when processing untrusted XSLT; review application logs for heap-related errors after stylesheet processing.

What your security team should do

• Apply the listed package upgrade immediately on all affected systems
• Scan for and replace any statically linked copies of the vulnerable libxslt
• Restrict processing of untrusted XSLT stylesheets until patches are deployed