CVE-2012-2870: libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory,...

Security readout for executives and security teams

This is an old memory-management flaw in libxslt, including its use in Chrome before 21.0.1180.89. A crafted XSLT expression could crash an affected application. The public record describes denial of service, not data theft or code execution. Exposure is most plausible in legacy browsers, operating systems, or applications bundling libxslt 1.1.26 or earlier. Modern managed packages are likely fixed, but embedded or static copies may persist. Treat as a legacy hygiene issue unless affected software processes untrusted XSLT today. Business risk is service disruption from crashes, with no sourced evidence of active exploitation or code execution. Mitigation focus: Upgrade Chrome to 21.0.1180.89 or later where relevant.; Update libxslt through the operating system or vendor package channel.; Inventory products that bundle or statically link libxslt..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.