Vulnerability · NVD
CVE-2025-24855
HIGH 7.8
Vendor bulletin scale — NVD CVSS pending
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
EPSS
0.35%
exploit very unlikely
percentile 27.4%
OS versions that fix this CVE
This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.