Executive brief
A vulnerability in the libxml2 library, which is widely used for processing XML data, could allow an attacker to crash applications. By providing a specially crafted XML expression, an attacker can trigger a system crash (denial of service), potentially disrupting business operations or services that rely on this library for data processing. This issue also affects certain Siemens Ruggedcom industrial networking devices that use the vulnerable library.
Technical details
A stack overflow vulnerability exists in libxml2's XPath evaluation engine due to uncontrolled recursion. The functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were found to reset the recursion depth counter to zero before making certain recursive calls, effectively bypassing depth limits. An attacker can exploit this by providing a deeply nested or complex XPath expression, leading to a stack overflow and application crash (Denial of Service). The fix involves ensuring recursion depth is preserved and correctly tracked across these function calls. This vulnerability is also inherited by downstream products like Siemens Ruggedcom Rox II.
Affected products
- GNOME libxml2 up to and including 2.9.14
- Siemens Ruggedcom Rox II family versions before 2.17.1
Timeline
- 2025-09-10: disclosed: Initial disclosure by Canonical Ltd.
- 2025-09-10: advisory: NVD published date
- 2025-09-30: patched: Debian LTS security update released
- 2026-05-12: advisory: Siemens published advisory SSA-577017 for Ruggedcom Rox products