Security readout for executives and security teams
Plain-English summary
CVE-2025-10911 is a libxslt memory-safety flaw that can crash an application when it processes specially crafted XSL content. The documented impact is service availability; the supplied CVSS assessment identifies no confidentiality or integrity loss. Exploitation requires local access and user interaction, limiting broad remote risk.
Executive priority
Schedule remediation through the normal vulnerability cycle, prioritizing business-critical services that transform attacker-influenced XSL. Escalate where crashes could disrupt essential operations or where local, untrusted users can submit content. Current evidence does not justify emergency treatment based on active exploitation.
Technical view
Libxslt may retain key data across result tree fragments and later dereference an expired pointer while parsing XSL nodes, causing a use-after-free classified as CWE-825. CVSS 3.1 is 5.5: local access, low complexity, no privileges, user interaction, unchanged scope, and high availability impact.
Likely exposure
Exposure exists where affected libxslt packages or listed Red Hat products process attacker-influenced XSL content. The bundle identifies affected RHEL 6, 8, 9, and 10 variants, plus certain Red Hat Discovery, Hardened Images, and Update Infrastructure components. Exact application reachability requires local inventory and data-flow review.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation. The CVSS vector requires local access and user interaction. A successful trigger is expected to crash the affected process; the sources do not substantiate code execution, data theft, or data modification.
Researcher notes
The bundle establishes a use-after-free and crash outcome but does not fully describe trigger constraints, affected upstream version ranges, or universal fixed versions. Red Hat advisories cover multiple product streams and should be evaluated individually. Treat stronger impacts as unproven unless upstream or vendor evidence establishes them.
Mitigation direction
- Inventory libxslt packages and applications that process XSL or XSLT content.
- Review the applicable Red Hat advisory for supported corrected packages and installation requirements.
- Apply vendor-prescribed updates through normal change-control processes.
- Restrict untrusted users from supplying XSL content until affected systems are remediated.
- Isolate critical transformation workloads where immediate updating is unavailable.
Validation and detection
- Compare installed package versions and product streams with the applicable Red Hat advisory.
- Confirm updated packages originate from supported vendor repositories.
- Restart or redeploy dependent applications if required by vendor guidance.
- Test legitimate XSLT workloads after remediation and monitor for crashes.
- Verify untrusted XSL input cannot reach any remaining affected processors.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-825: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-10911 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H1.83.6redhatVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Made public.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Reported to Red Hat.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2026:11015CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:26355CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:28243CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:28584CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:29807CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:29809CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:29811CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:29814CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:29975CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:29976CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:30847CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:33313CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:44481CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2026:58981CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-10911CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2397838CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/libxslt/-/issues/144CVE reference, redhat
- https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Expired Pointer Dereference
Expired Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.