CVE-2025-8732: libxml2 xmlcatalog xmlParseSGMLCatalog recursion

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-08 · updated 2026-07-01
Weakness: CWE-404

Description

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

Affected products

IBM AIX: from 7.2.5 before 7.2.5.12; from 7.3.2 before 7.3.3.3; 7.3.4 — fixed in 7.2.5.12, 7.3.3.3
IBM VIOS: from 4.1.0 before 4.1.1.30; 4.1.2.0 — fixed in 4.1.1.30
Siemens RUGGEDCOM RST2428P: before 4.0 — fixed in 4.0
xmlsoft libxml2: before 2.15.2 — fixed in 2.15.2

How to fix

Upgrade to a fixed version: IBM AIX 7.2.5.12, 7.3.3.3; IBM VIOS 4.1.1.30; Siemens RUGGEDCOM RST2428P 4.0; xmlsoft libxml2 2.15.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-8732 or the next vulnerability affects your stack