Uncontrolled Recursion Vulnerability in libxml2 Affecting GNOME Products

CVE-2025-9714

What is CVE-2025-9714?

The libxml2 library contains a vulnerability that allows local attackers to exploit uncontrolled recursion during XPath evaluation. This issue can lead to a stack overflow when crafted expressions trigger recursive calls of XPath processing functions. Prior to the recent fix, functions such as xmlXPathRunEval, xmlXPathCtxtCompile, and xmlXPathEvalExpr incorrectly reset recursion depth, enabling an attacker to initiate excessively deep recursive calls, thereby interrupting application functionality. The updated version now ensures that recursion depth is maintained, effectively mitigating the risk of stack overflow.

References