CVE-2025-9714: Stack overflow in libxml2
A critical stack overflow vulnerability was discovered in the libxslt library when handling the dyn:map() function from the EXSLT extension. The vulnerability allows an attacker to cause a denial of service (DoS) via a specially crafted XSLT document containing the recursive dyn:map(., .) call.
The main reason of the vulnerability is that the exsltDynMapFunction function in libexslt/dynamic.c doesn’t contain a recursion depth check. When handling dyn:map(., .) where the second parameter contains a recursive call to the same function, infinite recursion occurs until the program stack is exhausted.
Other sources
Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libxml2to a version that resolves this vulnerability.Fixed in 2.9.14
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9714?
CVE-2025-9714 is classified as a high-severity vulnerability due to the risk of local attackers causing a stack overflow.
How do I fix CVE-2025-9714?
To mitigate CVE-2025-9714, upgrade libxml2 to version 2.9.15 or later, where the recursion issue is addressed.
Who is affected by CVE-2025-9714?
CVE-2025-9714 affects all users of libxml2 versions up to and including 2.9.14.
What type of vulnerability is CVE-2025-9714?
CVE-2025-9714 is an uncontrolled recursion vulnerability that can lead to a stack overflow.
What are the potential impacts of CVE-2025-9714?
The potential impacts of CVE-2025-9714 include application crashes or denial of service due to stack overflow.