# CVE-2025-10911: Libxslt: use-after-free with key data stored cross-rvt

CVE-2025-10911 is fixed in 19 products on 1 platform, first by RHSA-2026:29809, released August 4, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-10911
- Priority: Routine
- CVSS: 5.5 (Moderate)
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 4, 2025
- Weakness: Expired Pointer Dereference
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10911

## Description

This update for libxml2 fixes the following issues:  - CVE-2026-0990: Fixed a call stack overflow leading to application crash due to infinite recursion in `xmlCatalogXMLResolveURI`. (bsc#1256807, bsc#1256811) - CVE-2026-0992: Fixed an excessive resource consumption when processing XML catalogs due to exponential behavior. (bsc#1256809, bsc#1256812) - CVE-2026-1757: Fixed a memory leak in the `xmllint` interactive shell. (bsc#1257594, bsc#1257595) - CVE-2025-10911: Fixed a use-after-free with key data stored cross-RVT. (bsc#1250553) - CVE-2025-8732: Fixed an infinite recursion in catalog parsing functions when processing malformed SGML catalog files. (bsc#1247858) - CVE-2026-0989: Fixe a call stack exhaustion leading to application crash due to RelaxNG parser not limiting the recursion depth. (bsc#1256805, bsc#1256810)

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libxml2 opensuse-leap 15.6 | 2.10.3-150500.5.38.1 | [SUSE-SU-2026:0570-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0570-1.md) | Feb 17, 2026 |
| Linux | libxml2 opensuse-leap 16.0 | 2.13.8-160000.4.1 | [OPENSUSE-SU-2026:20312-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20312-1.md) | Mar 4, 2026 |
| Linux | libxml2 sles 15.7 | 2.12.10-150700.4.11.1 | [SUSE-SU-2026:0605-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0605-1.md) | Feb 24, 2026 |
| Linux | libxml2 sles 16.0 | 2.13.8-160000.4.1 | [SUSE-SU-2026:20631-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20631-1.md) | Mar 4, 2026 |
| Linux | libxml2-python opensuse-leap 15.6 | 2.10.3-150500.5.38.1 | [SUSE-SU-2026:0570-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0570-1.md) | Feb 17, 2026 |
| Linux | libxml2-python opensuse-leap 16.0 | 2.13.8-160000.4.1 | [OPENSUSE-SU-2026:20312-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20312-1.md) | Mar 4, 2026 |
| Linux | libxml2-python sles 15.7 | 2.12.10-150700.4.11.1 | [SUSE-SU-2026:0605-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0605-1.md) | Feb 24, 2026 |
| Linux | libxml2-python sles 16.0 | 2.13.8-160000.4.1 | [SUSE-SU-2026:20631-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20631-1.md) | Mar 4, 2026 |
| Linux | libxslt Debian 14 | 1.1.43-0.3 | [DEBIAN-CVE-2025-10911](https://patchblox.com/security/data/fix/linux/debian-cve-2025-10911.md) | Sep 25, 2025 |
| Linux | libxslt RHEL 10 | 1.1.39-8.el10_0.1 | [RHSA-2026:29809](https://patchblox.com/security/data/fix/linux/rhsa-2026-29809.md) | Aug 4, 2025 |
| Linux | libxslt RHEL 8 | 0:1.1.32-6.4.el8_10 | [RHSA-2026:26355](https://patchblox.com/security/data/fix/linux/rhsa-2026-26355.md) | Jun 24, 2026 |
| Linux | libxslt RHEL 9 | 0:1.1.34-14.el9_8.1 | [RHSA-2026:28243](https://patchblox.com/security/data/fix/linux/rhsa-2026-28243.md) | Jun 24, 2026 |
| Linux | libxslt almalinux 10 | 1.1.39-8.el10_2.1 | [ALSA-2026:28584](https://patchblox.com/security/data/fix/linux/alsa-2026-28584.md) | Jun 23, 2026 |
| Linux | libxslt almalinux 8 | 1.1.32-6.4.el8_10 | [ALSA-2026:26355](https://patchblox.com/security/data/fix/linux/alsa-2026-26355.md) | Jun 16, 2026 |
| Linux | libxslt almalinux 9 | 1.1.34-14.el9_8.1 | [ALSA-2026:28243](https://patchblox.com/security/data/fix/linux/alsa-2026-28243.md) | Jun 23, 2026 |
| Linux | libxslt amzn 2023 | 1.1.43-1.amzn2023.0.3 | [ALAS2023-2025-1228](https://patchblox.com/security/data/fix/linux/alas2023-2025-1228.md) | Oct 27, 2025 |
| Linux | libxslt ol 10 | 0:1.1.39-8.el10_2.1 | [ELSA-2026-28584](https://patchblox.com/security/data/fix/linux/elsa-2026-28584.md) | Jul 16, 2026 |
| Linux | libxslt ol 8 | 0:1.1.32-6.4.0.1.el8_10 | [ELSA-2026-26355](https://patchblox.com/security/data/fix/linux/elsa-2026-26355.md) | Jun 16, 2026 |
| Linux | libxslt ol 9 | 0:1.1.34-14.0.1.el9_8.1 | [ELSA-2026-28243](https://patchblox.com/security/data/fix/linux/elsa-2026-28243.md) | Jun 23, 2026 |
| Linux | libxslt opensuse-leap 15.6 | 1.1.34-150400.3.16.1 | [SUSE-SU-2026:0801-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0801-1.md) | Mar 4, 2026 |
| Linux | libxslt opensuse-leap 15.6 | 1.1.34-150400.3.13.1 | [SUSE-SU-2025:3875-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3875-1.md) | Oct 30, 2025 |
| Linux | libxslt opensuse-leap 16.0 | 1.1.43-160000.4.1 | [OPENSUSE-SU-2026:20312-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20312-1.md) | Mar 4, 2026 |
| Linux | libxslt rocky 10 | 0:1.1.39-8.el10_2.1 | [RLSA-2026:28584](https://patchblox.com/security/data/fix/linux/rlsa-2026-28584.md) | Jun 25, 2026 |
| Linux | libxslt rocky 8 | 0:1.1.32-6.4.el8_10 | [RLSA-2026:26355](https://patchblox.com/security/data/fix/linux/rlsa-2026-26355.md) | Jun 17, 2026 |
| Linux | libxslt rocky 9 | 0:1.1.34-14.el9_7.1 | [RLSA-2026:28243](https://patchblox.com/security/data/fix/linux/rlsa-2026-28243.md) | Jun 24, 2026 |
| Linux | libxslt sles 15.6 | 1.1.34-150400.3.13.1 | [SUSE-SU-2025:3875-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3875-1.md) | Oct 30, 2025 |
| Linux | libxslt sles 15.7 | 1.1.34-150400.3.16.1 | [SUSE-SU-2026:0801-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0801-1.md) | Mar 4, 2026 |
| Linux | libxslt sles 15.7 | 1.1.34-150400.3.13.1 | [SUSE-SU-2025:3875-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3875-1.md) | Oct 30, 2025 |
| Linux | libxslt sles 16.0 | 1.1.43-160000.4.1 | [SUSE-SU-2026:20631-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20631-1.md) | Mar 4, 2026 |
| Linux | libxslt-debuginfo amzn 2023 | 1.1.43-1.amzn2023.0.3 | [ALAS2023-2025-1228](https://patchblox.com/security/data/fix/linux/alas2023-2025-1228.md) | Oct 27, 2025 |
| Linux | libxslt-debugsource amzn 2023 | 1.1.43-1.amzn2023.0.3 | [ALAS2023-2025-1228](https://patchblox.com/security/data/fix/linux/alas2023-2025-1228.md) | Oct 27, 2025 |
| Linux | libxslt-devel RHEL 8 | 0:1.1.32-6.4.el8_10 | [RHSA-2026:26355](https://patchblox.com/security/data/fix/linux/rhsa-2026-26355.md) | Jun 24, 2026 |
| Linux | libxslt-devel RHEL 9 | 0:1.1.34-14.el9_8.1 | [RHSA-2026:28243](https://patchblox.com/security/data/fix/linux/rhsa-2026-28243.md) | Jun 24, 2026 |
| Linux | libxslt-devel almalinux 10 | 1.1.39-8.el10_2.1 | [ALSA-2026:28584](https://patchblox.com/security/data/fix/linux/alsa-2026-28584.md) | Jun 23, 2026 |
| Linux | libxslt-devel almalinux 8 | 1.1.32-6.4.el8_10 | [ALSA-2026:26355](https://patchblox.com/security/data/fix/linux/alsa-2026-26355.md) | Jun 16, 2026 |
| Linux | libxslt-devel almalinux 9 | 1.1.34-14.el9_8.1 | [ALSA-2026:28243](https://patchblox.com/security/data/fix/linux/alsa-2026-28243.md) | Jun 23, 2026 |
| Linux | libxslt-devel amzn 2023 | 1.1.43-1.amzn2023.0.3 | [ALAS2023-2025-1228](https://patchblox.com/security/data/fix/linux/alas2023-2025-1228.md) | Oct 27, 2025 |
| Linux | libxslt-devel ol 10 | 0:1.1.39-8.el10_2.1 | [ELSA-2026-28584](https://patchblox.com/security/data/fix/linux/elsa-2026-28584.md) | Jul 16, 2026 |
| Linux | libxslt-devel ol 8 | 0:1.1.32-6.4.0.1.el8_10 | [ELSA-2026-26355](https://patchblox.com/security/data/fix/linux/elsa-2026-26355.md) | Jun 16, 2026 |
| Linux | libxslt-devel ol 9 | 0:1.1.34-14.0.1.el9_8.1 | [ELSA-2026-28243](https://patchblox.com/security/data/fix/linux/elsa-2026-28243.md) | Jun 23, 2026 |
| Linux | libxslt-python opensuse-leap 15.6 | 1.1.32-150000.3.25.1 | [SUSE-SU-2025:03595-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03595-1.md) | Oct 14, 2025 |
| Linux | libxslt1.1 Ubuntu 26.04.1 LTS (resolute) | 1.1.43-0.3 | [libxslt1.1 1.1.43-0.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libxslt1.1-1.1.43-0.3.md) | Oct 13, 2025 |
| Linux | mingw-libxslt Fedora 43 | 1.1.43-4.fc43 | [FEDORA-2026-84BE018D47](https://patchblox.com/security/data/fix/linux/fedora-2026-84be018d47.md) | Jan 13, 2026 |
| Linux | mingw32-libxslt Fedora 43 | 1.1.43-4.fc43 | [FEDORA-2026-84BE018D47](https://patchblox.com/security/data/fix/linux/fedora-2026-84be018d47.md) | Jan 13, 2026 |
| Linux | mingw32-libxslt-debuginfo Fedora 43 | 1.1.43-4.fc43 | [FEDORA-2026-84BE018D47](https://patchblox.com/security/data/fix/linux/fedora-2026-84be018d47.md) | Jan 13, 2026 |
| Linux | mingw32-libxslt-static Fedora 43 | 1.1.43-4.fc43 | [FEDORA-2026-84BE018D47](https://patchblox.com/security/data/fix/linux/fedora-2026-84be018d47.md) | Jan 13, 2026 |
| Linux | mingw64-libxslt Fedora 43 | 1.1.43-4.fc43 | [FEDORA-2026-84BE018D47](https://patchblox.com/security/data/fix/linux/fedora-2026-84be018d47.md) | Jan 13, 2026 |
| Linux | mingw64-libxslt-debuginfo Fedora 43 | 1.1.43-4.fc43 | [FEDORA-2026-84BE018D47](https://patchblox.com/security/data/fix/linux/fedora-2026-84be018d47.md) | Jan 13, 2026 |
| Linux | mingw64-libxslt-static Fedora 43 | 1.1.43-4.fc43 | [FEDORA-2026-84BE018D47](https://patchblox.com/security/data/fix/linux/fedora-2026-84be018d47.md) | Jan 13, 2026 |
| Linux | python-libxml2-python opensuse-leap 15.6 | 2.9.7-150000.3.94.1 | [SUSE-SU-2026:0568-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0568-1.md) | Feb 17, 2026 |
| Linux | python3-libxslt amzn 2023 | 1.1.43-1.amzn2023.0.3 | [ALAS2023-2025-1228](https://patchblox.com/security/data/fix/linux/alas2023-2025-1228.md) | Oct 27, 2025 |
| Linux | python3-libxslt-debuginfo amzn 2023 | 1.1.43-1.amzn2023.0.3 | [ALAS2023-2025-1228](https://patchblox.com/security/data/fix/linux/alas2023-2025-1228.md) | Oct 27, 2025 |
| Linux | xsltproc Ubuntu 26.04.1 LTS (resolute) | 1.1.43-0.3 | [xsltproc 1.1.43-0.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-xsltproc-1.1.43-0.3.md) | Oct 13, 2025 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.