PT-2025-41849 · Libxslt+3 · Libxslt+3

Published 2025-07-23 · Updated 2026-03-27 · CVE-2025-11731

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions libxslt (affected versions not specified)

Description A flaw exists in the exsltFuncResultComp() function of libxslt, which processes EXSLT <func:result> elements during stylesheet parsing. The issue stems from incorrect type handling, where the function may incorrectly interpret an XML document node as an XML element node, leading to a type confusion. This can result in unexpected memory reads and potential application crashes. While exploitation is considered difficult, the flaw could lead to application instability or denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

AZL-70550

AZL-70601

BDU:2026-02739

CVE-2025-11731

ECHO-C04A-8EBF-D378

OESA-2026-1724

OESA-2026-1725

OESA-2026-1726

OESA-2026-1727

OESA-2026-1728

OPENSUSE-SU-2025:15641-1

OPENSUSE-SU-2025:20050-1

RHSA-2026:11015

SUSE-SU-2025:20892-1

SUSE-SU-2025:20897-1

SUSE-SU-2025:21008-1

SUSE-SU-2025:21031-1

SUSE-SU-2025:3743-1

SUSE-SU-2025:3778-1

SUSE-SU-2025:3875-1

SUSE-SU-2025_3743-1

SUSE-SU-2025_3778-1

SUSE-SU-2026:0603-1

Affected Products

Debian

Red Os

Suse

Libxslt

References · 62

• https://osv.dev/vulnerability/OESA-2026-1724 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1725 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15641-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3743-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-70550 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-11731 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1726 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-11731 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:20050-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11731 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:3778-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21008-1 · Vendor Advisory