Vulnerability record · CVE-2025-8732 · published 8 August 2025
CVE-2025-8732: Xmlsoft libxml2 improper resource shutdown vulnerability
Xmlsoft · Libxml2
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."
Description
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link | Broken Link |
| https://gitlab.gnome.org/GNOME/libxml2/-/issues/958 | ExploitIssue TrackingThird Party Advisory |
| https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853 | ExploitIssue TrackingThird Party Advisory |
| https://vuldb.com/?ctiid.319228 | Permissions RequiredThird Party Advisory |
| https://vuldb.com/?id.319228 | Permissions RequiredThird Party Advisory |
| https://vuldb.com/?submit.622285 | Permissions RequiredThird Party Advisory |
| https://cert-portal.siemens.com/productcert/html/ssa-253495.html | Third Party Advisory |
Track CVE-2025-8732 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-8732), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.