CVE-2025-8732: ibm aix Improper Resource Shutdown or Release
Vulnerability summary
CVE-2025-8732 is a medium (CVSS 4.8) Improper Resource Shutdown or Release vulnerability in ibm aix. EPSS estimates a 0.22% chance of exploitation in the next 30 days, higher than 11.2% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 12 · Related 12Timeline
- 08-08-2025PublishedVulnerability first disclosed.
- 02-06-2026Last modifiedVulnerability information updated.
Description
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."
CVSS metrics
10 scores · 4 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- OSV · DebianEcosystem advisory · calculated4.8MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST1.9LowCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST1.7LowAV:L/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.22%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
+0.01 pp
From 0.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (drive.google.com)
Maturity: unknown
Exploit Reference (gitlab.gnome.org)
Maturity: unknown
Exploit Reference (gitlab.gnome.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected systems
Debian1 product
- libxml2< 2.9.14+dfsg-1.3~deb12u6 | < 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | < 2.15.2+dfsg-0.1
Siemens1 product
Ubuntu1 product
- libxml2< 2.9.1+dfsg1-3ubuntu4.13+esm11 | < 2.9.3+dfsg1-1ubuntu0.7+esm12 | < 2.9.4+dfsg1-6.1ubuntu1.9+esm7 | < 2.9.10+dfsg-5ubuntu0.20.04.10+esm4 | < 2.9.13+dfsg-1ubuntu0.11 | < 2.9.14+dfsg-1.3ubuntu3.7 | < 2.14.5+dfsg-0.2ubuntu0.1
Xmlsoft1 product
- libxml2< 2.15.2
5 vendors · 6 products
References
12 links- drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_linkExploitREPORTBroken Link
- cert-portal.siemens.com/productcert/html/ssa-253495.htmlThird Party Advisory
