Check the library inside the service that handles XML. The browser update for this CVE covers a different product.
Microsoft’s November CVRF added Azure Linux 3.0 libxslt 1.1.43-3 for CVE-2026-125350 on November 13 at 01:09 UTC. MSRC rates the package Important, CVSS 3.1 8.8. MSRC uses the Chromium XML use-after-free description and does not give a separate Azure Linux attack path or complete affected range. Prioritize applications that transform untrusted XML or stylesheets while you establish exposure.
Google confirmed exploitation in Chromium. CISA added the CVE to KEV November 10, with a November 24 federal deadline. Exploitation of Azure Linux workloads remains unverified. Microsoft’s Azure Linux row provides no fixed build, and the production x86-64 and Arm64 indexes still list the affected build.
Suggested MSP priority. Expedite inventory of Azure Linux 3.0 hosts and images running XML transformations. Where an affected service accepts untrusted input, restrict that processing until a fix is verified. Roll out a signed Azure Linux package or rebuilt image when Microsoft identifies a fixed build. Verify the package actually loaded by the service and retest the XML workflow. Microsoft’s row gives no package-specific workaround or compromise-check requirement.
Last verified November 13, 2026 UTC. MSRC November CVRF · Azure Linux x86-64 packages · Azure Linux Arm64 packages · CISA KEV.