This vulnerability in libxslt, part of the libxml2 library, arises from a use-after-free condition caused by corruption of the attribute type (atype) in xmlAttrPtr structures. When XSLT functions such as key() produce tree fragments, this corruption prevents proper cleanup of ID attributes, leading to access of freed memory. This can result in application crashes or heap corruption. The issue has been assigned CVSS 3.1 score 7.8 (high severity) with attack vector local, high attack complexity, no privileges required, no user interaction, and scope changed. Red Hat has issued security advisories and patches for affected Red Hat Enterprise Linux 9 and 10 versions.

Successful exploitation can cause heap corruption or crashes in applications using the vulnerable libxml2/libxslt libraries. This may lead to denial of service or potentially enable further exploitation due to memory corruption. The CVSS score of 7.8 indicates a high impact on integrity and availability. There are no confirmed reports of exploitation in the wild.

Official patches are available from Red Hat for Red Hat Enterprise Linux 9 and 10. Users should apply the updated libxml2 and libxslt packages as provided in Red Hat advisories RHSA-2025:12447 and RHBA-2025:12345. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.