CVE-2025-11731

A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:11015
https://access.redhat.com/security/cve/CVE-2025-11731
https://bugzilla.redhat.com/show_bug.cgi?id=2403688
https://gitlab.gnome.org/GNOME/libxslt/-/issues/151
https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró un fallo en la función exsltFuncResultComp() de libxslt, que maneja los elementos EXSLT <func:result> durante el análisis de hojas de estilo. Debido a un manejo de tipos incorrecto, la función puede tratar un nodo de documento XML como un nodo de elemento XML regular, lo que resulta en una confusión de tipos. Esto puede causar lecturas de memoria inesperadas y posibles bloqueos. Aunque difícil de explotar, el fallo podría provocar inestabilidad en la aplicación o denegación de servicio.

Information

Published : 2025-10-14 06:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-11731

Mitre link : CVE-2025-11731

CVE.ORG link : CVE-2025-11731

JSON object : View

Products Affected

No product.

CWE

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2025-11731", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11731", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T15:18:32.705297Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"versions": [{"status": "affected", "version": "0", "lessThan": "1.1.44", "versionType": "semver"}], "packageName": "libxslt", "collectionURL": "https://gitlab.gnome.org/GNOME/libxslt", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "versions": [{"status": "unaffected", "version": "1.1.45-0.1.hum1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libxslt-main", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "libxslt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-10-14T06:15:34.483", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:11015", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-11731", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403688", "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/151", "source": "secalert@redhat.com"}, {"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/78", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service."}, {"lang": "es", "value": "Se encontr\u00f3 un fallo en la funci\u00f3n exsltFuncResultComp() de libxslt, que maneja los elementos EXSLT <func:result> durante el an\u00e1lisis de hojas de estilo. Debido a un manejo de tipos incorrecto, la funci\u00f3n puede tratar un nodo de documento XML como un nodo de elemento XML regular, lo que resulta en una confusi\u00f3n de tipos. Esto puede causar lecturas de memoria inesperadas y posibles bloqueos. Aunque dif\u00edcil de explotar, el fallo podr\u00eda provocar inestabilidad en la aplicaci\u00f3n o denegaci\u00f3n de servicio."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "secalert@redhat.com"}