Log in Start free

Vulnerability · Published Aug 8, 2025 · Assigned by VulDB

CVE-2025-8732libxml2 xmlcatalog xmlParseSGMLCatalog recursion

Low 3.3

In plain English

A low-severity security flaw in libxml2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 85.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libxml22.9.14+dfsg-1.3~deb12u6DEBIAN-CVE-2025-8732
Debian:13libxml22.12.7+dfsg+really2.9.14-2.1+deb13u3DEBIAN-CVE-2025-8732
Debian:14libxml22.15.2+dfsg-0.1DEBIAN-CVE-2025-8732
Ubuntu:22.04:LTSlibxml22.9.13+dfsg-1ubuntu0.11UBUNTU-CVE-2025-8732
Ubuntu:24.04:LTSlibxml22.9.14+dfsg-1.3ubuntu3.7UBUNTU-CVE-2025-8732
Ubuntu:25.10libxml22.14.5+dfsg-0.2ubuntu0.1UBUNTU-CVE-2025-8732

Affected products (as reported)

VendorProductVersions
n/a libxml2 2.14.02.14.12.14.22.14.32.14.42.14.5

Weakness: CWE-674, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

References