CVE-2025-9714: libxml2 before 2.10.0 (exclusive), 0 to before 2.10.0, 0 to before 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, 0 to before…

Affected technology

libxml2 · before 2.10.0 (exclusive)
xmlsoft

libxml2 · 0 to before 2.10.0, 0 to before 2.12.7+dfsg+really2.9.14-0.4ubuntu0.3, 0 to before 2.9.14+dfsg-1.3ubuntu3.5, 0 to before 2.9.13+dfsg-1ubuntu0.9, 0 to before 2.9.10+dfsg-5ubuntu0.20.04.10+esm2, 0 to before 2.9.4+dfsg1-6.1ubuntu1.9+esm5, 0 to before 2.9.3+dfsg1-1ubuntu0.7+esm10, 0 to before 2.9.1+dfsg1-3ubuntu4.13+esm9
libxml2

RUGGEDCOM ROX MX5000 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX MX5000RE · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1400 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1500 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1501 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1510 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1511 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1512 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1524 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX1536 · 0 to before V2.17.1
Siemens

RUGGEDCOM ROX RX5000 · 0 to before V2.17.1
Siemens

Description’s affected range: up to and including version 2.9.14

Component: xpath
File: xpath.c

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local attacker can cause a stack overflow via crafted expressions. Vendor/CNA’s CVSS 3.1 assessment (base score 6.2/10) rates confidentiality and integrity impact as none; availability impact as high. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as high.