CVE-2025-9714

What it actually does

Uncontrolled recursion in XPath evaluation functions (xmlXPathRunEval, xmlXPathCtxtCompile, xmlXPathEvalExpr) in libxml2 <= 2.9.14 due to resetting recursion depth before recursive calls, enabling stack overflow via crafted expressions.

Why it matters to the business

Applications relying on libxml2 for XML/XPath processing can be crashed by local input, causing denial of service, interrupted services, and potential data processing failures across dependent systems.

How an attack unfolds

A local attacker supplies a crafted XPath expression to an application using vulnerable libxml2; the reset recursion depth in evaluation functions allows unbounded recursion leading to stack exhaustion and process crash.

How to fix it

Upgrade libxml2 to a build containing commit 677a42645ef22b5a50741bad5facf9d8a8bc6d21 or later; rebuild and redeploy all dependent applications.

How to confirm the fix worked

Verify installed libxml2 version and commit; attempt reproduction with known recursion-triggering expressions in a test environment to confirm absence of crash.

Typical attack path

1. Locate an application or service that invokes libxml2 XPath processing on attacker-controlled input
2. Craft a malicious XPath expression designed to trigger deep recursion
3. Submit the expression through local interfaces, files, or APIs
4. Trigger evaluation to exhaust stack memory and crash the process

How to detect it

Review application crash logs and core dumps for stack overflows involving XPath functions; correlate with recent XML/XPath processing activity.

• xmlXPathRunEval
• xmlXPathCtxtCompile
• xmlXPathEvalExpr
• stack overflow in libxml2 XPath evaluation

What your security team should do

• Prioritize upgrade of libxml2 across all systems and containers
• Inventory applications and libraries depending on libxml2
• Implement input validation or sandboxing around XPath processing where upgrades are delayed
• Monitor application stability metrics for XPath-related crashes