JLSEC-2026-583 numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an...

numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal...

CVE-2025-24855

CVE-2025-24855 affects libxslt, specifically numbers.c, where a use-after-free can occur during nested XPath evaluations if the XPath context node is modified but not restored. The issue is documented as a Use-After-Free in numbers.c and is connected to related code paths xsltNumberFormatGetValue...