A heap-based memory corruption vulnerability in libxslt affects multiple versions of Red Hat Enterprise Linux and the GNOME libxml2 library, posing a significant risk of system instability or unauthorized code execution.

This is a Use After Free (CWE-416) vulnerability occurring when XSLT functions, such as key() processing, generate tree fragments. The resulting improper cleanup of ID attributes allows for access to freed memory, which can be manipulated to trigger heap corruption.

The exploitation of this vulnerability can lead to service disruption via application crashes or potential arbitrary code execution, depending on the attacker's ability to manipulate the heap. With a CVSS score of 7.8, this flaw represents a high risk to business continuity and system integrity, particularly in environments processing untrusted XML or XSLT inputs.

Immediate Action: Update the libxslt and related packages to the versions specified in the relevant Red Hat security advisories (RHSA-2025:12447, RHSA-2025:12450, RHSA-2025:13267, RHSA-2025:13308, RHSA-2025:13309, RHSA-2025:13310, RHSA-2025:13311).

Proactive Monitoring: Monitor system logs for unexpected segmentation faults or service crashes that correlate with XML transformation tasks.

Compensating Controls: Implement strict input validation for all XML and XSLT files processed by the application to limit the potential for triggering the vulnerable code path.

Public Exploit Available: No (exploit_available: false)

Given the potential for heap corruption and the existence of proof-of-concept evidence, organizations should prioritize patching affected systems. Administrators must review the provided Red Hat errata links to identify the precise package versions required for their specific RHEL environment and deploy these updates through standard patch management workflows to mitigate the risk of exploitation.