CVE-2025-9714

Stack overflow in libxml2

MEDIUM

5.5

CVSS Score

Published: September 10, 2025 at 06:43 PM UTC

Updated: October 19, 2026 at 05:10 PM UTC

13 products affected across 3 vendorsLIBXML2LIBXML2RUGGEDCOM Rox RX1510 Firmware

Using libxml2 by libxml2?

Get instant alerts when new vulnerabilities affect libxml2 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

LIBXML2 · Xmlsoft

95%

All versionsv < 2.10.0

LIBXML2 · LIBXML2

90%

0 ≤ v < 2.10.00 ≤ v < 2.12.7+dfsg+really2.9.14-0.4ubuntu0.30 ≤ v < 2.9.1+dfsg1-3ubuntu4.13+esm90 ≤ v < 2.9.10+dfsg-5ubuntu0.20.04.10+esm20 ≤ v < 2.9.13+dfsg-1ubuntu0.90 ≤ v < 2.9.14+dfsg-1.3ubuntu3.50 ≤ v < 2.9.3+dfsg1-1ubuntu0.7+esm100 ≤ v < 2.9.4+dfsg1-6.1ubuntu1.9+esm5

Affected range stops below 2.10.0, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.9.1+dfsg1-3ubuntu4.13+esm9, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.9.13+dfsg-1ubuntu0.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.9.14+dfsg-1.3ubuntu3.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.9.3+dfsg1-1ubuntu0.7+esm10, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.9.4+dfsg1-6.1ubuntu1.9+esm5, so it looks safe — our inference, not a vendor statement

RUGGEDCOM Rox MX5000 Firmware · Siemens

60%

v < V2.17.1