A heap use‑after‑free flaw exists in libxslt caused by corruption of the attribute type field during XSLT processing. The vulnerability can lead to crashes or, if exploited, to arbitrary heap corruption. The affected memory area is used for ID attribute cleanup. The weakness is enumerated as CWE‑416.

This vulnerability impacts the libxslt library bundled with GNOME’s libxml2 and is present in many Red Hat products, including Red Hats Enterprise Linux releases 6 through 10, the Red Hat OpenShift Container Platform (4.12–4.19), Red Hat OpenShift distributed tracing, file‑integrity operator, compliance operator, and several Red Hat tools such as the Discovery appliance, Insights proxy, and Web Terminal. All affected systems that invoke libxslt for XSLT transformations, whether in user applications or system services, are susceptible.

The CVSS score of 7.8 classifies the issue as high severity, while an EPSS score of less than 1% indicates a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread publicly available exploits at the time of analysis. Exploitation requires an attacker to supply malicious XSLT input to a running process that uses libxslt; if successful, the attacker could cause a crash or achieve arbitrary code execution via heap corruption. The likely attack vector is remote or local depending on how the vulnerable XSLT engine is exposed, but the impact is limited to the compromised process.