CVE-2025-11731: Libxslt: type confusion in exsltfuncresultcompfunction of libxslt
A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes. While difficult to exploit, the flaw could lead to application instability or denial of service.
Other sources
Libxslt: type confusion in exsltfuncresultcompfunction of libxslt
— Microsoft
Type Confusion vulnerability in the EXSLT <func:result> element handler of libxslt. The flaw resides in the exsltFuncResultComp() function, which walks up the node hierarchy to verify that a <func:result> is a descendant of a func:function element. If no such ancestor exists, the loop continues until the XML document node is reached, where the ns pointer is incorrectly interpreted as integer fields (compression and standalone). This type confusion results in reading memory from an unexpected address, leading to a segmentation fault or crash. Although the impact is limited to denial-of-service, the issue can be triggered remotely by processing malicious XSL stylesheets.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11731?
CVE-2025-11731 has a medium severity rating due to its potential for type confusion in XML processing.
How do I fix CVE-2025-11731?
To fix CVE-2025-11731, update your libxslt to the latest version that addresses this vulnerability.
What software is affected by CVE-2025-11731?
CVE-2025-11731 affects the libxslt component of XML processing libraries.
What are the potential risks of CVE-2025-11731?
The potential risks of CVE-2025-11731 include unexpected behavior in XML processing that could lead to program instability.
When was CVE-2025-11731 reported?
CVE-2025-11731 was reported in 2025 as part of ongoing security assessments for XML libraries.