CVE-2025-7425
| Severity | 7.8 High CVSS 3.1 |
|---|---|
| Weakness | Use after free (CWE-416) |
| Published | 10 Jul 2025 |
| Updated | 13 Nov 2026 |
Description
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: total.
- Indexed PoC none indexed
- EPSS 0.44% chance in 30 days
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher set this CVE's status to Outside Waratek scope. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
https://www.oracle.com/security-alerts/cpujan2026.html
This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update January 2026 ↗ | CPU | 2026-Q1 | Oracle Java SE / JavaFX (libxslt) (Oracle Java SE: 8u471-b50) Oracle's note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). |
| Oracle Critical Patch Update October 2025 ↗ | CPU | 2025-Q4 | Oracle Communications / Configuration (libxml2) (25.1.200) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Configuration (libxml2) | 25.1.200 | 25.1.200 |
| Oracle Java SE | JavaFX (libxslt) | Oracle Java SE: 8u471-b50 | 8.0.471.50 |
References
Timeline
Timeline
| Published | 2025-07-10 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-11-06 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |