Geometric data blocks representing critical software vulnerabilities and LLM insights.

Daily Cybersecurity News - December 26, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

December 26, 2025 3:32 PM 4 min read

CVE-2025-7425: Libxslt Heap Use-After-Free Vulnerability

High

Executive Summary

CVE-2025-7425 is a heap use-after-free vulnerability in libxslt caused by atype corruption in xmlattrptr, potentially leading to memory corruption and application crashes. The vulnerability has a CVSS score of 7.8 (High) and its status is that patches are available for some systems, but mitigation may not be readily available for all.

Vulnerability Details

Affected Product: libxslt on Red Hat Enterprise Linux (RHEL 7 ELS, RHEL 8, RHEL 9) and SUSE Linux Enterprise (SLES 12 SP5).
Identifier: CVE-2025-7425
CVSS Score: 7.8 (High)
Exploitation Status: No active exploitation has been confirmed, but similar vulnerabilities have been exploited in the past.

Risk & Impact

Triage: Immediate patching is recommended due to the potential for memory corruption, application crashes, and potential arbitrary code execution.
Attack Vector: The vulnerability can be triggered by crafting malicious XSLT stylesheets or XML documents. The attack vector is local with high attack complexity.
Ease of Exploit: Exploitation requires specific conditions or expertise due to the high attack complexity.

Action Plan

Immediate Action:
Apply vendor patches immediately. For RHEL 9, upgrade to libxslt-1.1.34-13.el9_6. For RHEL 8, ensure versions are 2.9.7-21.el8_10.2 or later. For RHEL 7 ELS, update to 2.9.1-6.el7_9.12.
Workaround: Implement a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to identify and block attempts to exploit this vulnerability as a temporary mitigation.
Detection: Monitor for modifications to attribute type flags and unusual memory access patterns.

Relevant professional terms

Heap Use-After-Free: A type of vulnerability that occurs when a program attempts to access memory on the heap that has already been freed, potentially leading to crashes or arbitrary code execution.
Atype Corruption: The modification of attribute type flags in a way that corrupts internal memory management, leading to improper cleanup of ID attributes.

Source: Red Hat Customer Portal

Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection

Critical

Executive Summary

A critical serialization injection vulnerability, identified as CVE-2025-68664, exists in LangChain Core, potentially allowing attackers to steal sensitive secrets and influence LLM responses through prompt injection. The vulnerability is considered critical with a CVSS score of 9.3.

Vulnerability Details

Affected Product: LangChain Core versions >= 1.0.0 and < 1.2.5 (Fixed in 1.2.5) and versions < 0.3.81 (Fixed in 0.3.81).
Identifier: CVE-2025-68664
CVSS Score: 9.3 (Critical)
Exploitation Status: Potentially exploitable through prompt injection

Risk & Impact

Triage: Immediate action is required due to the high severity and potential for sensitive data exposure.
Attack Vector: The vulnerability can be exploited by injecting malicious code through user-controlled data, such as LLM outputs influenced by prompt injection, which is then serialized and deserialized.
Ease of Exploit: Relatively easy, as it involves exploiting the serialization and deserialization process with a crafted 'lc' key.

Action Plan

Immediate Action: Upgrade to LangChain Core version 1.2.5 or 0.3.81 or later.
Workaround: Ensure that the "secrets_from_env" option is set to "False" to prevent automatic loading of secrets from the environment. Sanitize user inputs and outputs to prevent the injection of 'lc' keys.
Detection: Monitor for unusual serialization and deserialization activities, especially those involving the 'lc' key. Implement logging and alerting for suspicious activities.

Relevant professional terms

Serialization Injection: A type of vulnerability that occurs when an attacker can inject malicious serialized data into an application, leading to arbitrary code execution or other unintended consequences.
Prompt Injection: A security vulnerability unique to large language models (LLMs) where an attacker manipulates the prompts to cause the model to perform unintended actions or reveal sensitive information.

Source: The Hacker News

Trust Wallet Chrome Extension Exploit

Executive Summary

A compromised update to the Trust Wallet Chrome extension (version 2.68) on December 24, 2025, led to the theft of approximately $7 million in cryptocurrency from user wallets. The malicious update injected code that captured users' seed phrases, allowing attackers to drain funds.

Attack Overview

Attack Path: A malicious update to the Trust Wallet Chrome extension (version 2.68) injected malicious JavaScript code (4482.js) that exfiltrated user seed phrases.

Impact Assessment

Data Stolen: User seed phrases, leading to the theft of approximately $7 million in cryptocurrencies, including Bitcoin, Ethereum, and BNB.

Detection & Hunting

IOCs: api.metrics-trustwallet[.]com (C2/Exfiltration domain)

Strategic Takeaway

The incident highlights the risks associated with browser-based cryptocurrency wallets and the importance of verifying software updates.

Relevant professional terms

Seed Phrase: A series of words that can be used to recover a cryptocurrency wallet.
Supply Chain Attack: An attack that targets vulnerabilities in the software supply chain, such as compromised updates.

Source: Bleeping Computer

LLMs Aid Vulnerability Scoring, Context Still Key

Executive Summary

A recent study investigates the potential of Large Language Models (LLMs) to automate vulnerability scoring, revealing promising results in specific areas but highlighting persistent weaknesses that hinder fully automated scoring. The study suggests that while LLMs can assist, human context remains crucial for accurate vulnerability assessments.

Key Findings

LLMs show promise in scoring vulnerabilities at scale, potentially easing the burden on stretched security teams.
Gemini reached approximately 89% accuracy on the Attack Vector metric, which describes how an attacker reaches the vulnerable system.
GPT 5 also achieved around 89% accuracy on the User Interaction metric, reflecting whether the exploit requires user action.

The Bottom Line

While LLMs can process vulnerability data at scale, security teams should not rely solely on automated scoring. The study indicates that LLMs still struggle with nuanced vulnerability descriptions, particularly in assessing Availability Impact (where accuracy dropped to ~68% even for top models). Human oversight remains essential to ensure accurate risk assessment and prioritization, especially where detailed contextual information is lacking.

Relevant Terms

LLM (Large Language Model): A deep learning model trained on vast amounts of data, capable of understanding and generating natural language.
Vulnerability Scoring: A standardized framework, such as CVSS, used to assess and communicate the severity of security vulnerabilities.

Source: Help Net Security