What’s Vulnerable › Vulnerabilities

CVE-2025-9714: Stack overflow in libxml2

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-10 · updated 2026-10-19
• Weakness: CWE-674

Description

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Affected products

• xmlsoft libxml2: before 2.10.0 — fixed in 2.10.0

How to fix

Upgrade to a fixed version: xmlsoft libxml2 2.10.0. Check the vendor advisory for mitigations.

References

• https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21
• https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html
• https://cert-portal.siemens.com/productcert/html/ssa-577017.html

Get alerted when CVE-2025-9714 or the next vulnerability affects your stack