Skip to content
Fencer Vulns
medium 6.2

CVE-2025-9714 json

Stack overflow in libxml2

published 2025-09-10 13 mo ago modified 2026-10-19 20 d ago also EUVD-2025-27609 , JLSEC-2025-91

cvss
6.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.

Patch / fix

  • julia XML2_jll 2.10.3+0
  • libxml2 libxml2 2.9.1+dfsg1-3ubuntu4.13+esm9, 2.9.3+dfsg1-1ubuntu0.7+esm10, 2.9.4+dfsg1-6.1ubuntu1.9+esm5, 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, 2.9.13+dfsg-1ubuntu0.9, 2.9.14+dfsg-1.3ubuntu3.5, 2.10.0, 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3
  • Siemens RUGGEDCOM ROX MX5000 V2.17.1
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.1
  • Siemens RUGGEDCOM ROX RX1400 V2.17.1
  • Siemens RUGGEDCOM ROX RX1500 V2.17.1
  • Siemens RUGGEDCOM ROX RX1501 V2.17.1
  • Siemens RUGGEDCOM ROX RX1510 V2.17.1
  • Siemens RUGGEDCOM ROX RX1511 V2.17.1
  • Siemens RUGGEDCOM ROX RX1512 V2.17.1
  • Siemens RUGGEDCOM ROX RX1524 V2.17.1
  • Siemens RUGGEDCOM ROX RX1536 V2.17.1
  • Siemens RUGGEDCOM ROX RX5000 V2.17.1
  • libxml2 Debian 12 2.9.14+dfsg-1.3~deb12u5
  • libxml2 Debian 13 2.12.7+dfsg+really2.9.14-2.1+deb13u2
  • libxml2 Debian 14 2.14.5+dfsg-0.1

debian advisories DEBIAN-CVE-2025-9714

  • libxml2 Ubuntu 22.04 LTS 2.9.13+dfsg-1ubuntu0.9
  • libxml2 Ubuntu 24.04 LTS 2.9.14+dfsg-1.3ubuntu3.5
  • libxml2 Ubuntu Pro 14.04 LTS 2.9.1+dfsg1-3ubuntu4.13+esm9
  • libxml2 Ubuntu Pro 16.04 LTS 2.9.3+dfsg1-1ubuntu0.7+esm10
  • libxml2 Ubuntu Pro 18.04 LTS 2.9.4+dfsg1-6.1ubuntu1.9+esm5
  • libxml2 Ubuntu Pro 20.04 LTS 2.9.10+dfsg-5ubuntu0.20.04.10+esm2

ubuntu advisories UBUNTU-CVE-2025-9714

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libxml2 RHEL 8 2.9.7-21.el8_10.4
  • python3-libxml2 RHEL 8 2.9.7-21.el8_10.4
  • libxml2 hummingbird 1 2.15.2-0.3.hum1
  • libxml2-16 hummingbird 1 2.15.2-0.3.hum1
  • python3-libxml2 hummingbird 1 2.15.2-0.3.hum1
  • libxml2 RHEL 9 2.9.13-14.el9_7
  • python3-libxml2 RHEL 9 2.9.13-14.el9_7
  • libxml2 RHEL 7 ELS 2.9.1-6.el7_9.14

red hat advisories RHSA-2026:22420RHSA-2026:15967RHSA-2026:14858RHSA-2026:14832RHSA-2026:11349RHSA-2026:7519

  • libxml2 SLE Micro 5.4, SLE Micro 5.3 2.9.14-150400.5.50.1
  • libxml2-python SLE Micro 5.4, SLE Micro 5.3 2.9.14-150400.5.50.1
  • libxml2 SLE Micro 5.2 2.9.7-150000.3.88.1
  • python-libxml2-python SLE Micro 5.2, openSUSE Leap 15.6 2.9.7-150000.3.88.1
  • libxml2 SLES LTSS Extended Security 12 SP5 2.9.4-46.93.1
  • python-libxml2 SLES LTSS Extended Security 12 SP5 2.9.4-46.93.1

suse advisories SUSE-SU-2025:4116-1SUSE-SU-2025:4115-1SUSE-SU-2025:4104-1

  • libxml2 AlmaLinux 8 2.9.7-21.el8_10.8
  • python3-libxml2 AlmaLinux 8 2.9.7-21.el8_10.8
  • libxml2 AlmaLinux 8 2.9.7-21.el8_10.4
  • python3-libxml2 AlmaLinux 8 2.9.7-21.el8_10.4
  • libxml2 AlmaLinux 9 2.9.13-14.el9_7
  • python3-libxml2 AlmaLinux 9 2.9.13-14.el9_7

almalinux advisories ALSA-2026:69655ALSA-2026:11349ALSA-2025:22376

  • libxml2 Rocky Linux 8 2.9.7-21.el8_10.4
  • libxml2 Rocky Linux 9 2.9.13-14.el9_7

rocky linux advisories RLSA-2026:11349RLSA-2025:22376

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9714 updated cvss 6.2

libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c

  • Red Hat Enterprise Linux 6 libxml2, libxml2-python
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat AI Inference Server 3.2 rhaiis 1772160593, rhaiis 1772160625, rhaiis 3.2.5-1765361180, rhaiis 3.2.5-1765361184, rhaiis 3.2.5-1765552580, rhaiis 3.2.5-1765552603, +1 more
    fixed: vendor fix RHSA-2025:23202
  • Red Hat Ceph Storage 7 rhceph
    fixed: vendor fix RHSA-2025:23234
  • Red Hat Ceph Storage 8 rhceph, rhceph 1769512383
    fixed: vendor fix RHSA-2026:1652
  • Red Hat Discovery 2 discovery 1767888970, discovery 1767904573
    fixed: vendor fix RHSA-2026:0414
  • Red Hat Enterprise Linux AppStream (v. 8) libxml2-devel 2.9.7-21.el8_10.4, libxml2-debuginfo 2.9.7-21.el8_10.4, libxml2-debugsource 2.9.7-21.el8_10.4, python3-libxml2-debuginfo 2.9.7-21.el8_10.4
    fixed: vendor fix RHSA-2026:11349
  • Red Hat Enterprise Linux AppStream (v. 9) libxml2-devel 2.9.13-14.el9_7, libxml2-debuginfo 2.9.13-14.el9_7, libxml2-debugsource 2.9.13-14.el9_7, python3-libxml2-debuginfo 2.9.13-14.el9_7
    fixed: vendor fix RHSA-2025:22376
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libxml2-devel 2.9.7-9.el8_4.9, libxml2-debuginfo 2.9.7-9.el8_4.9, libxml2-debugsource 2.9.7-9.el8_4.9, python3-libxml2-debuginfo 2.9.7-9.el8_4.9
    fixed: vendor fix RHSA-2026:14832
show 29 more
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libxml2-devel 2.9.7-13.el8_6.13, libxml2-debuginfo 2.9.7-13.el8_6.13, libxml2-debugsource 2.9.7-13.el8_6.13, python3-libxml2-debuginfo 2.9.7-13.el8_6.13 Red Hat Enterprise Linux AppStream E4S (v.8.6) libxml2-devel 2.9.7-13.el8_6.13, libxml2-debuginfo 2.9.7-13.el8_6.13, libxml2-debugsource 2.9.7-13.el8_6.13, python3-libxml2-debuginfo 2.9.7-13.el8_6.13
    fixed: vendor fix RHSA-2026:15967
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libxml2-devel 2.9.7-16.el8_8.13, libxml2-debuginfo 2.9.7-16.el8_8.13, libxml2-debugsource 2.9.7-16.el8_8.13, python3-libxml2-debuginfo 2.9.7-16.el8_8.13
    fixed: vendor fix RHSA-2026:14858
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) libxml2-devel 2.9.13-1.el9_0.8, libxml2-debuginfo 2.9.13-1.el9_0.8, libxml2-debugsource 2.9.13-1.el9_0.8, python3-libxml2-debuginfo 2.9.13-1.el9_0.8
    fixed: vendor fix RHSA-2025:22177
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) libxml2-devel 2.9.13-3.el9_2.10, libxml2-debuginfo 2.9.13-3.el9_2.10, libxml2-debugsource 2.9.13-3.el9_2.10, python3-libxml2-debuginfo 2.9.13-3.el9_2.10
    fixed: vendor fix RHSA-2025:22162
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) libxml2-devel 2.9.13-13.el9_4, libxml2-debuginfo 2.9.13-13.el9_4, libxml2-debugsource 2.9.13-13.el9_4, python3-libxml2-debuginfo 2.9.13-13.el9_4
    fixed: vendor fix RHSA-2025:22163
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) libxml2-devel 2.9.13-12.el9_6.1, libxml2-debuginfo 2.9.13-12.el9_6.1, libxml2-debugsource 2.9.13-12.el9_6.1, python3-libxml2-debuginfo 2.9.13-12.el9_6.1
    fixed: vendor fix RHSA-2025:22377
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libxml2-devel 2.9.7-9.el8_4.9, libxml2-debuginfo 2.9.7-9.el8_4.9, libxml2-debugsource 2.9.7-9.el8_4.9, python3-libxml2-debuginfo 2.9.7-9.el8_4.9
    fixed: vendor fix RHSA-2026:14832
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) libxml2-devel 2.9.7-13.el8_6.13, libxml2-debuginfo 2.9.7-13.el8_6.13, libxml2-debugsource 2.9.7-13.el8_6.13, python3-libxml2-debuginfo 2.9.7-13.el8_6.13
    fixed: vendor fix RHSA-2026:15967
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libxml2-devel 2.9.7-16.el8_8.13, libxml2-debuginfo 2.9.7-16.el8_8.13, libxml2-debugsource 2.9.7-16.el8_8.13, python3-libxml2-debuginfo 2.9.7-16.el8_8.13
    fixed: vendor fix RHSA-2026:14858
  • Red Hat Enterprise Linux BaseOS (v. 8) libxml2 2.9.7-21.el8_10.4, python3-libxml2 2.9.7-21.el8_10.4
    fixed: vendor fix RHSA-2026:11349
  • Red Hat Enterprise Linux BaseOS (v. 9) libxml2 2.9.13-14.el9_7, python3-libxml2 2.9.13-14.el9_7
    fixed: vendor fix RHSA-2025:22376
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) libxml2 2.9.7-9.el8_4.9, python3-libxml2 2.9.7-9.el8_4.9
    fixed: vendor fix RHSA-2026:14832
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) libxml2 2.9.7-13.el8_6.13, python3-libxml2 2.9.7-13.el8_6.13 Red Hat Enterprise Linux BaseOS E4S (v.8.6) libxml2 2.9.7-13.el8_6.13, python3-libxml2 2.9.7-13.el8_6.13
    fixed: vendor fix RHSA-2026:15967
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) libxml2 2.9.7-16.el8_8.13, python3-libxml2 2.9.7-16.el8_8.13
    fixed: vendor fix RHSA-2026:14858
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) libxml2 2.9.13-1.el9_0.8, python3-libxml2 2.9.13-1.el9_0.8
    fixed: vendor fix RHSA-2025:22177
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) libxml2 2.9.13-3.el9_2.10, python3-libxml2 2.9.13-3.el9_2.10
    fixed: vendor fix RHSA-2025:22162
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) libxml2 2.9.13-13.el9_4, python3-libxml2 2.9.13-13.el9_4
    fixed: vendor fix RHSA-2025:22163
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) libxml2 2.9.13-12.el9_6.1, python3-libxml2 2.9.13-12.el9_6.1
    fixed: vendor fix RHSA-2025:22377
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) libxml2 2.9.7-9.el8_4.9, python3-libxml2 2.9.7-9.el8_4.9
    fixed: vendor fix RHSA-2026:14832
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) libxml2 2.9.7-13.el8_6.13, python3-libxml2 2.9.7-13.el8_6.13
    fixed: vendor fix RHSA-2026:15967
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) libxml2 2.9.7-16.el8_8.13, python3-libxml2 2.9.7-16.el8_8.13
    fixed: vendor fix RHSA-2026:14858
  • Red Hat Enterprise Linux Server (v. 7 ELS) libxml2 2.9.1-6.el7_9.14, libxml2-python 2.9.1-6.el7_9.14 Red Hat Enterprise Linux Server Optional (v. 7 ELS) libxml2-static 2.9.1-6.el7_9.14, libxml2-debuginfo 2.9.1-6.el7_9.14
    fixed: vendor fix RHSA-2026:22420
  • Red Hat Hardened Images libxml2 2.15.2-0.3.hum1, libxml2-16 2.15.2-0.3.hum1, python3-libxml2 2.15.2-0.3.hum1
    fixed: vendor fix RHSA-2026:7519
  • Red Hat Insights proxy 1.5 insights-proxy 1.5.9-1765201856
    fixed: vendor fix RHSA-2025:22868
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202605271418
    fixed: vendor fix RHSA-2026:21695
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202601130113
    fixed: vendor fix RHSA-2026:0677
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202601191325
    fixed: vendor fix RHSA-2026:0996
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202601271320
    fixed: vendor fix RHSA-2026:1541
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202601160124
    fixed: vendor fix RHSA-2026:0985

4 more fixed, 4 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-134-16 updated cvss 6.2

Siemens Ruggedcom Rox

  • Siemens RUGGEDCOM ROX MX5000 < 2.17.1 Siemens RUGGEDCOM ROX MX5000RE < 2.17.1 Siemens RUGGEDCOM ROX RX1400 < 2.17.1 Siemens RUGGEDCOM ROX RX1500 < 2.17.1 Siemens RUGGEDCOM ROX RX1501 < 2.17.1 Siemens RUGGEDCOM ROX RX1510 < 2.17.1
    +5 more products
    Siemens RUGGEDCOM ROX RX1511 < 2.17.1 Siemens RUGGEDCOM ROX RX1512 < 2.17.1 Siemens RUGGEDCOM ROX RX1524 < 2.17.1 Siemens RUGGEDCOM ROX RX1536 < 2.17.1 Siemens RUGGEDCOM ROX RX5000 < 2.17.1
    affected: fixed in V2.17.1 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
13 mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
julia XML2_jll
<2.10.3+0
2.10.3+0

Affected products

  • libxml2 libxml2
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.