Vulnerability-Lookup

CVE-2025-9714 (GCVE-0-2025-9714)

Vulnerability from cvelistv5 – Published: 2025-09-10 18:43 – Updated: 2026-05-12 12:02

Title

Stack overflow in libxml2

Summary

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-10 18:46 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

canonical mitre root

References

3 references

URL	Tags
https://gitlab.gnome.org/GNOME/libxml2/-/commit/6…	patch
https://lists.debian.org/debian-lts-announce/2025…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

12 products

Vendor	Product	Version	CPE status
libxml2	libxml2	Affected: 0 , < 2.10.0 (semver) Affected: 0 , < 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3 (dpkg) Affected: 0 , < 2.9.14+dfsg-1.3ubuntu3.5 (dpkg) Affected: 0 , < 2.9.13+dfsg-1ubuntu0.9 (dpkg) Affected: 0 , < 2.9.10+dfsg-5ubuntu0.20.04.10+esm2 (dpkg) Affected: 0 , < 2.9.4+dfsg1-6.1ubuntu1.9+esm5 (dpkg) Affected: 0 , < 2.9.3+dfsg1-1ubuntu0.7+esm10 (dpkg) Affected: 0 , < 2.9.1+dfsg1-3ubuntu4.13+esm9 (dpkg)	guessed
Siemens	RUGGEDCOM ROX MX5000	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX MX5000RE	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1400	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1500	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1501	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1510	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1511	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1512	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1524	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX1536	Affected: 0 , < V2.17.1 (custom)	guessed
Siemens	RUGGEDCOM ROX RX5000	Affected: 0 , < V2.17.1 (custom)	guessed

Credits

Nikita Sveshnikov (Positive Technologies)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9714",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-10T18:46:42.383800Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-10T18:46:46.622Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T18:14:19.914Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX MX5000RE",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1400",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1500",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1501",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1510",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1511",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1512",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1524",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX1536",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM ROX RX5000",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V2.17.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:02:43.668Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/libxml2",
          "defaultStatus": "unaffected",
          "modules": [
            "xpath"
          ],
          "packageName": "libxml2",
          "platforms": [
            "Linux"
          ],
          "product": "libxml2",
          "programFiles": [
            "xpath.c"
          ],
          "repo": "https://gitlab.gnome.org/GNOME/libxml2",
          "vendor": "libxml2",
          "versions": [
            {
              "lessThan": "2.10.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "2.12.7+dfsg+really2.9.14-0.4ubuntu0.3",
              "status": "affected",
              "version": "0",
              "versionType": "dpkg"
            },
            {
              "lessThan": "2.9.14+dfsg-1.3ubuntu3.5",
              "status": "affected",
              "version": "0",
              "versionType": "dpkg"
            },
            {
              "lessThan": "2.9.13+dfsg-1ubuntu0.9",
              "status": "affected",
              "version": "0",
              "versionType": "dpkg"
            },
            {
              "lessThan": "2.9.10+dfsg-5ubuntu0.20.04.10+esm2",
              "status": "affected",
              "version": "0",
              "versionType": "dpkg"
            },
            {
              "lessThan": "2.9.4+dfsg1-6.1ubuntu1.9+esm5",
              "status": "affected",
              "version": "0",
              "versionType": "dpkg"
            },
            {
              "lessThan": "2.9.3+dfsg1-1ubuntu0.7+esm10",
              "status": "affected",
              "version": "0",
              "versionType": "dpkg"
            },
            {
              "lessThan": "2.9.1+dfsg1-3ubuntu4.13+esm9",
              "status": "affected",
              "version": "0",
              "versionType": "dpkg"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nikita Sveshnikov (Positive Technologies)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eUncontrolled recursion in\u0026nbsp;XPath evaluation\u0026nbsp;in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `\u003ccode\u003exmlXPathCtxtCompile\u003c/code\u003e`, and `\u003ccode\u003exmlXPathEvalExpr\u003c/code\u003e` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.\u003c/div\u003e"
            }
          ],
          "value": "Uncontrolled recursion in\u00a0XPath evaluation\u00a0in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-10T18:43:12.204Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Stack overflow in libxml2",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2025-9714",
    "datePublished": "2025-09-10T18:43:12.204Z",
    "dateReserved": "2025-08-29T23:28:33.339Z",
    "dateUpdated": "2026-05-12T12:02:43.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-9714",
      "date": "2026-09-17",
      "epss": "0.00155",
      "percentile": "0.05016"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-9714\",\"sourceIdentifier\":\"security@ubuntu.com\",\"published\":\"2025-09-10T19:15:42.707\",\"lastModified\":\"2026-06-17T10:09:35.520\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Uncontrolled recursion in\u00a0XPath evaluation\u00a0in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.\"}],\"affected\":[{\"source\":\"security@ubuntu.com\",\"affectedData\":[{\"vendor\":\"libxml2\",\"product\":\"libxml2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://gitlab.gnome.org/GNOME/libxml2\",\"packageName\":\"libxml2\",\"modules\":[\"xpath\"],\"platforms\":[\"Linux\"],\"programFiles\":[\"xpath.c\"],\"repo\":\"https://gitlab.gnome.org/GNOME/libxml2\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.10.0\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.12.7+dfsg+really2.9.14-0.4ubuntu0.3\",\"versionType\":\"dpkg\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.9.14+dfsg-1.3ubuntu3.5\",\"versionType\":\"dpkg\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.9.13+dfsg-1ubuntu0.9\",\"versionType\":\"dpkg\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.9.10+dfsg-5ubuntu0.20.04.10+esm2\",\"versionType\":\"dpkg\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.9.4+dfsg1-6.1ubuntu1.9+esm5\",\"versionType\":\"dpkg\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.9.3+dfsg1-1ubuntu0.7+esm10\",\"versionType\":\"dpkg\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.9.1+dfsg1-3ubuntu4.13+esm9\",\"versionType\":\"dpkg\",\"status\":\"affected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX MX5000\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX MX5000RE\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1400\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1500\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1501\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1510\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1511\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1512\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1524\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX1536\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM ROX RX5000\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V2.17.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-09-10T18:46:42.383800Z\",\"id\":\"CVE-2025-9714\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-674\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.10.0\",\"matchCriteriaId\":\"6A6A3E8A-FBA5-4AA0-B9D8-F2536DB076F0\"}]}]}],\"references\":[{\"url\":\"https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-577017.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T17:01:50+00:00",
      "cve": "CVE-2025-9714",
      "id": "CVE-2025-9714",
      "initial_release_date": "2025-09-02T00:00:00+00:00",
      "product_status:fixed": "536",
      "product_status:known_affected": "6",
      "product_status:known_not_affected": "62",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9714.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-9714\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-10T18:46:42.383800Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-10T18:46:43.927Z\"}}], \"cna\": {\"title\": \"Stack overflow in libxml2\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Nikita Sveshnikov (Positive Technologies)\"}], \"impacts\": [{\"capecId\": \"CAPEC-130\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-130 Excessive Allocation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.2, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://gitlab.gnome.org/GNOME/libxml2\", \"vendor\": \"libxml2\", \"modules\": [\"xpath\"], \"product\": \"libxml2\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.10.0\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.12.7+dfsg+really2.9.14-0.4ubuntu0.3\", \"versionType\": \"dpkg\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.9.14+dfsg-1.3ubuntu3.5\", \"versionType\": \"dpkg\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.9.13+dfsg-1ubuntu0.9\", \"versionType\": \"dpkg\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.9.10+dfsg-5ubuntu0.20.04.10+esm2\", \"versionType\": \"dpkg\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.9.4+dfsg1-6.1ubuntu1.9+esm5\", \"versionType\": \"dpkg\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.9.3+dfsg1-1ubuntu0.7+esm10\", \"versionType\": \"dpkg\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.9.1+dfsg1-3ubuntu4.13+esm9\", \"versionType\": \"dpkg\"}], \"platforms\": [\"Linux\"], \"packageName\": \"libxml2\", \"programFiles\": [\"xpath.c\"], \"collectionURL\": \"https://gitlab.gnome.org/GNOME/libxml2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21\", \"tags\": [\"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Uncontrolled recursion in\\u00a0XPath evaluation\\u00a0in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eUncontrolled recursion in\u0026nbsp;XPath evaluation\u0026nbsp;in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `\u003ccode\u003exmlXPathCtxtCompile\u003c/code\u003e`, and `\u003ccode\u003exmlXPathEvalExpr\u003c/code\u003e` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.\u003c/div\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-674\", \"description\": \"CWE-674 Uncontrolled Recursion\"}]}], \"providerMetadata\": {\"orgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"shortName\": \"canonical\", \"dateUpdated\": \"2025-09-10T18:43:12.204Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-9714\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-09-10T18:46:46.622Z\", \"dateReserved\": \"2025-08-29T23:28:33.339Z\", \"assignerOrgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"datePublished\": \"2025-09-10T18:43:12.204Z\", \"assignerShortName\": \"canonical\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-FMJ5-RVMP-845R

Vulnerability from github – Published: 2025-09-10 21:30 – Updated: 2026-05-12 15:31

Details

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Severity

6.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-9714"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-10T19:15:42Z",
    "severity": "MODERATE"
  },
  "details": "Uncontrolled recursion in\u00a0XPath evaluation\u00a0in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.",
  "id": "GHSA-fmj5-rvmp-845r",
  "modified": "2026-05-12T15:31:05Z",
  "published": "2025-09-10T21:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9714"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

ICSA-26-134-16

Vulnerability from csaf_cisa - Published: 2026-05-12 00:00 - Updated: 2026-05-14 06:00

Summary

Siemens Ruggedcom Rox

Scope

35 vulnerabilities in this advisory, including CVE-2025-9714.

CVE-2025-9714

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known affected: 11 products

https://support.industry.siemens.com/cs/ww/en/view/110002017/

Open the full advisory

NCSC-2026-0147

Vulnerability from csaf_ncscnl - Published: 2026-05-13 06:33 - Updated: 2026-05-13 06:33

Summary

Kwetsbaarheden verholpen in Siemens-producten

Scope

226 vulnerabilities in this advisory, including CVE-2025-9714.

CVE-2025-9714

Libxml2 versions up to 2.9.14 contain infinite recursion vulnerabilities in exsltDynMapFunction and catalog parsing functions, causing stack exhaustion and local denial of service without arbitrary memory corruption.

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known affected: 46 products

Open the full advisory

oesa-2025-2255

Vulnerability from osv_openeuler

Published

2025-09-12 11:09

Modified

2026-08-06 11:09

Summary

libxml2 security update

Details

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.

Security Fix(es):

A flaw was found in libxstl/libxml2. The 'exsltDynMapFunction' function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling 'dyn:map()', leading to stack exhaustion and a local denial of service.(CVE-2025-9714)

Severity

6.2 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-9714	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libxml2-2.9.10-50.oe2003sp4.aarch64.rpm",
          "libxml2-debuginfo-2.9.10-50.oe2003sp4.aarch64.rpm",
          "libxml2-debugsource-2.9.10-50.oe2003sp4.aarch64.rpm",
          "libxml2-devel-2.9.10-50.oe2003sp4.aarch64.rpm",
          "python2-libxml2-2.9.10-50.oe2003sp4.aarch64.rpm",
          "python3-libxml2-2.9.10-50.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "libxml2-help-2.9.10-50.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "libxml2-2.9.10-50.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "libxml2-2.9.10-50.oe2003sp4.x86_64.rpm",
          "libxml2-debuginfo-2.9.10-50.oe2003sp4.x86_64.rpm",
          "libxml2-debugsource-2.9.10-50.oe2003sp4.x86_64.rpm",
          "libxml2-devel-2.9.10-50.oe2003sp4.x86_64.rpm",
          "python2-libxml2-2.9.10-50.oe2003sp4.x86_64.rpm",
          "python3-libxml2-2.9.10-50.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "libxml2",
        "purl": "pkg:rpm/openEuler/libxml2\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.10-50.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX stream or and in-memory DOM like representations. In this case one can use the built-in XPath and XPointer implementation to select sub nodes or ranges. A flexible Input/Output mechanism is available, with existing HTTP and FTP modules and combined to an URI library.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libxstl/libxml2. The \u0026apos;exsltDynMapFunction\u0026apos; function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling \u0026apos;dyn:map()\u0026apos;, leading to stack exhaustion and a local denial of service.(CVE-2025-9714)",
  "id": "OESA-2025-2255",
  "modified": "2026-08-06T11:09:19Z",
  "published": "2025-09-12T11:09:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2255"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9714"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libxml2 security update",
  "upstream": [
    "CVE-2025-9714"
  ]
}

oesa-2025-2285

Vulnerability from osv_openeuler

Published

2025-09-12 11:09

Modified

2026-08-06 11:09

Summary

libxslt security update

Details

Libxslt is the XSLT C library developed for the GNOME project

Security Fix(es):

Severity

6.2 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-9714	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libxslt-1.1.34-10.oe2003sp4.aarch64.rpm",
          "libxslt-debuginfo-1.1.34-10.oe2003sp4.aarch64.rpm",
          "libxslt-debugsource-1.1.34-10.oe2003sp4.aarch64.rpm",
          "libxslt-devel-1.1.34-10.oe2003sp4.aarch64.rpm",
          "python2-libxslt-1.1.34-10.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "libxslt-help-1.1.34-10.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "libxslt-1.1.34-10.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "libxslt-1.1.34-10.oe2003sp4.x86_64.rpm",
          "libxslt-debuginfo-1.1.34-10.oe2003sp4.x86_64.rpm",
          "libxslt-debugsource-1.1.34-10.oe2003sp4.x86_64.rpm",
          "libxslt-devel-1.1.34-10.oe2003sp4.x86_64.rpm",
          "python2-libxslt-1.1.34-10.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "libxslt",
        "purl": "pkg:rpm/openEuler/libxslt\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.34-10.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Libxslt is the XSLT C library developed for the GNOME project\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libxstl/libxml2. The \u0026apos;exsltDynMapFunction\u0026apos; function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling \u0026apos;dyn:map()\u0026apos;, leading to stack exhaustion and a local denial of service.(CVE-2025-9714)",
  "id": "OESA-2025-2285",
  "modified": "2026-08-06T11:09:21Z",
  "published": "2025-09-12T11:09:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2285"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9714"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libxslt security update",
  "upstream": [
    "CVE-2025-9714"
  ]
}

RHSA-2025:22162

Vulnerability from csaf_redhat - Published: 2025-11-26 05:26 - Updated: 2026-08-31 17:08

Summary

Red Hat Security Advisory: libxml2 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9714.

CVE-2025-9714

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 45 products

https://access.redhat.com/errata/RHSA-2025:22162

Open the full advisory

RHSA-2025:22163

Vulnerability from csaf_redhat - Published: 2025-11-26 05:49 - Updated: 2026-08-31 17:08

Summary

Red Hat Security Advisory: libxml2 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9714.

CVE-2025-9714

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 45 products

https://access.redhat.com/errata/RHSA-2025:22163

Open the full advisory

RHSA-2025:22177

Vulnerability from csaf_redhat - Published: 2025-11-26 13:19 - Updated: 2026-08-31 17:08

Summary

Red Hat Security Advisory: libxml2 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9714.

CVE-2025-9714

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 45 products

https://access.redhat.com/errata/RHSA-2025:22177

Open the full advisory

RHSA-2025:22376

Vulnerability from csaf_redhat - Published: 2025-12-01 03:26 - Updated: 2026-08-31 17:08

Summary

Red Hat Security Advisory: libxml2 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9714.

CVE-2025-9714

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 45 products

https://access.redhat.com/errata/RHSA-2025:22376

Open the full advisory

RHSA-2025:22377

Vulnerability from csaf_redhat - Published: 2025-12-01 03:32 - Updated: 2026-08-31 17:08

Summary

Red Hat Security Advisory: libxml2 security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9714.

CVE-2025-9714

6.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 45 products

https://access.redhat.com/errata/RHSA-2025:22377

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-9714 (GCVE-0-2025-9714)

Vulnerability from osv_openeuler

Vulnerability from osv_openeuler

Tags

Sightings

Nomenclature

Related by attack behaviour