# CVE-2025-9714: GNOME libxml2 stack overflow in XPath evaluation

Source: https://junglewise.ai/threats/cve-2025-9714-gnome-libxml2-stack-overflow-in-xpath-evaluation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-10. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2025-9714 · Severity: medium · CVSS 6.2 · Published 2025-09-10

A vulnerability in the libxml2 library, which is widely used for processing XML data, could allow an attacker to crash applications. By providing a specially crafted XML expression, an attacker can trigger a system crash (denial of service), potentially disrupting business operations or services that rely on this library for data processing. This issue also affects certain Siemens Ruggedcom industrial networking devices that use the vulnerable library.

Technologies: [Siemens ROX II](https://junglewise.ai/threats/technologies/rox-ii), [Xmlsoft Libxml2](https://junglewise.ai/threats/technologies/libxml2). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens), [Xmlsoft](https://junglewise.ai/threats/vendors/xmlsoft).

## Quick answers

**Is CVE-2025-9714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-9714 being exploited in the wild.

**How severe is CVE-2025-9714?** Medium severity, with a CVSS score of 6.2, published 10 September 2025.

**Which products and versions are affected?** Siemens ROX II versions before 2.17.1.

**Is there a fix for CVE-2025-9714?** A patch was published on 2025-09-30: Debian LTS security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-9714 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-9714?** Check whether you run Siemens ROX II or Xmlsoft Libxml2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack overflow vulnerability exists in libxml2's XPath evaluation engine due to uncontrolled recursion. The functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were found to reset the recursion depth counter to zero before making certain recursive calls, effectively bypassing depth limits. An attacker can exploit this by providing a deeply nested or complex XPath expression, leading to a stack overflow and application crash (Denial of Service). The fix involves ensuring recursion depth is preserved and correctly tracked across these function calls. This vulnerability is also inherited by downstream products like Siemens Ruggedcom Rox II.

## Affected products

- GNOME libxml2 up to and including 2.9.14
- Siemens Ruggedcom Rox II family versions before 2.17.1

## Timeline

- 2025-09-10: disclosed: Initial disclosure by Canonical Ltd.
- 2025-09-10: advisory: NVD published date
- 2025-09-30: patched: Debian LTS security update released
- 2026-05-12: advisory: Siemens published advisory SSA-577017 for Ruggedcom Rox products

## References

- [https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21](https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21)
- [https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html](https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-577017.html](https://cert-portal.siemens.com/productcert/html/ssa-577017.html)

## Related threats

- [libxml2 xinclude parseFlags not propagated](https://junglewise.ai/threats/cve-2026-86144-libxml2-xinclude-parseflags-not-propagated)
- [libxml2 integer overflow in xmlOutputWriteCallback](https://junglewise.ai/threats/cve-2026-86143-libxml2-integer-overflow-in-xmloutputwritecallback)
- [libxml2 heap buffer overflow in xmlXPtrEvalXPtrPart](https://junglewise.ai/threats/cve-2026-86142-libxml2-heap-buffer-overflow-in-xmlxptrevalxptrpart)
- [libxml2 NULL pointer dereference in xmlRegNewParserCtxt](https://junglewise.ai/threats/cve-2026-86141-libxml2-null-pointer-dereference-in-xmlregnewparserctxt)
- [libxml2 stack-based buffer overflow in xmlSnprintfElements](https://junglewise.ai/threats/cve-2026-86140-libxml2-stack-based-buffer-overflow-in-xmlsnprintfelements)