CVE-2025-43708: Visicut

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='../../../set/set[2]' is used, aka an "insecure deserialization" issue.

Affected products

• Visicut Visicut: version 2.1 only

Published 2025-04-17. Last modified 2026-06-17.