CVE-2025-9714: Stack overflow in libxml2
A critical stack overflow vulnerability was discovered in the libxslt library when handling the dyn:map() function from the EXSLT extension. The vulnerability allows an attacker to cause a denial of service (DoS) via a specially crafted XSLT document containing the recursive dyn:map(., .) call. The main reason of the vulnerability is that the exsltDynMapFunction function in libexslt/dynamic.c doesn’t contain a recursion depth check. When handling dyn:map(., .) where the second parameter contains a recursive call to the same function, infinite recursion occurs until the program stack is exhausted.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9714?
CVE-2025-9714 is classified as a high-severity vulnerability due to the risk of local attackers causing a stack overflow.
How do I fix CVE-2025-9714?
To mitigate CVE-2025-9714, upgrade libxml2 to version 2.9.15 or later, where the recursion issue is addressed.
Who is affected by CVE-2025-9714?
CVE-2025-9714 affects all users of libxml2 versions up to and including 2.9.14.
What type of vulnerability is CVE-2025-9714?
CVE-2025-9714 is an uncontrolled recursion vulnerability that can lead to a stack overflow.
What are the potential impacts of CVE-2025-9714?
The potential impacts of CVE-2025-9714 include application crashes or denial of service due to stack overflow.