CVE-2025-10729
A critical vulnerability exists in a module that incorrectly handles <pattern> nodes. The flaw can lead to a use‑after‑free, potentially crashing the application or allowing an attacker to execute arbitrary code. The issue is local and requires no authentication.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Any software that incorporates the vulnerable module and processes XML or similar data containing <pattern> nodes. No specific product versions are listed in the available data.
Real-world impact
If an attacker can supply a crafted input that includes a <pattern> node outside a structural node, they could trigger a use‑after‑free. This could crash the application or, in some environments, allow the attacker to run code with the application's privileges.
Why this severity
The CVSS score of 9.4 reflects the high impact (confidentiality, integrity, availability) and the fact that the vulnerability can be exploited locally without authentication or user interaction. The vector shows that the attack requires local access and no privileges, making it highly dangerous.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Oct 3, 2025 · Oct 3, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.