A use‑after‑free flaw exists in libxslt during the parsing of XSL nodes. When the library processes certain XSL input, it may dereference pointers that have already been freed, causing the application to crash. The vulnerability falls under CWE‑825, reflecting a memory‑management issue. While the flaw is described as leading only to a crash, use‑after‑free bugs can potentially be leveraged for more serious failure modes if memory corruption is exploited, although no evidence of such exploitation is provided.

The flaw affects Red Hat Enterprise Linux releases 6 through 10, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, and the Hummingbird product. Any system that incorporates libxslt from the listed Red Hat packages is potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity. An EPSS score of less than 1 % shows a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV. Likely attack vectors involve supplying malicious XSL input to an application that uses libxslt; such input could be delivered remotely or locally depending on the application’s exposure. Because the flaw can cause a crash, it poses a denial‑of‑service risk to affected services. The overall risk is considered moderate and the exploitation probability low, but exposure remains if vulnerable components are deployed in environments where arbitrary XSL input can be received.