Libxslt Use-After-Free Vulnerability in Nested XPath Evaluations

A use-after-free vulnerability has been identified in libxslt versions prior to 1.1.43. The issue arises in numbers.c, where an XPath context node can be altered during nested XPath evaluations but not restored. This vulnerability is associated with the functions xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, which can potentially be exploited to execute arbitrary code or cause a denial-of-service.