{"schemaVersion":3,"id":"CVE-2025-8732","aliases":["UBUNTU-CVE-2025-8732","DEBIAN-CVE-2025-8732"],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that \"[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all.\"","dates":{"published":"2025-08-08T16:32:06.990Z","modified":"2026-06-02T12:59:45.337Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.8,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":4.8,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.3,"severity":"low","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"CVE.org","score":3.3,"severity":"low","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"CVE.org","score":1.7,"severity":"low","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":4.8,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":3.3,"severity":"low","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","exploitability":4.6,"impact":2.3,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":4.8,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":1.9,"severity":"low","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.3,"severity":"low","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":1.7,"severity":"low","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00216,"percentile":0.11255,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.009000000000000024,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00207},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00216,"percentile":0.11255}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00216,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00216,"percentile":0.11255}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_4E66FDC30BA91E04","name":"Exploit Reference (drive.google.com)","source":"reference","url":"https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_B4EB0BDC78B19699","name":"Exploit Reference (gitlab.gnome.org)","source":"reference","url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/958","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_42C89AEA09B9F03A","name":"Exploit Reference (gitlab.gnome.org)","source":"reference","url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":3,"weaknesses":[{"id":"CWE-404","name":"Improper Resource Shutdown or Release","description":"The product does not release or incorrectly releases a resource before it is made available for re-use.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/404.html"},{"id":"CWE-674","name":"Uncontrolled Recursion","description":"The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/674.html"}],"affected":[{"vendor":"debian","product":"libxml2","name":"libxml2","label":"libxml2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libxml2","purlType":"deb","versions":[{"text":"< 2.9.14+dfsg-1.3~deb12u6","noFixRecorded":false,"fixedIn":null},{"text":"< 2.12.7+dfsg+really2.9.14-2.1+deb13u3","noFixRecorded":false,"fixedIn":null},{"text":"< 2.15.2+dfsg-0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.14+dfsg-1.3~deb12u6 | < 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | < 2.15.2+dfsg-0.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libxml2","name":"libxml2","label":"libxml2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libxml2","purlType":"deb","versions":[{"text":"< 2.9.1+dfsg1-3ubuntu4.13+esm11","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.3+dfsg1-1ubuntu0.7+esm12","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.4+dfsg1-6.1ubuntu1.9+esm7","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.10+dfsg-5ubuntu0.20.04.10+esm4","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.13+dfsg-1ubuntu0.11","noFixRecorded":false,"fixedIn":null},{"text":"< 2.9.14+dfsg-1.3ubuntu3.7","noFixRecorded":false,"fixedIn":null},{"text":"< 2.14.5+dfsg-0.2ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.1+dfsg1-3ubuntu4.13+esm11 | < 2.9.3+dfsg1-1ubuntu0.7+esm12 | < 2.9.4+dfsg1-6.1ubuntu1.9+esm7 | < 2.9.10+dfsg-5ubuntu0.20.04.10+esm4 | < 2.9.13+dfsg-1ubuntu0.11 | < 2.9.14+dfsg-1.3ubuntu3.7 | < 2.14.5+dfsg-0.2ubuntu0.1","eol":null,"hubHref":null},{"vendor":"ibm","product":"aix","name":"aix","label":"aix","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 7.2.5, < 7.2.5.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.3.2, < 7.3.3.3","noFixRecorded":false,"fixedIn":null},{"text":"7.3.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.2.5, < 7.2.5.12 | ≥ 7.3.2, < 7.3.3.3 | 7.3.4","eol":{"isEol":false,"eolDate":"2028-12-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7.3.4","label":"7.3 TL4","eolFrom":"2028-12-31T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"7.3.4"},"product":{"name":"ibm-aix","label":"IBM AIX","category":"os"}},"hubHref":"/vendor/ibm/aix"},{"vendor":"ibm","product":"vios","name":"vios","label":"vios","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 4.1.0, < 4.1.1.30","noFixRecorded":false,"fixedIn":null},{"text":"4.1.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 4.1.0, < 4.1.1.30 | 4.1.2.0","eol":null,"hubHref":"/vendor/ibm/vios"},{"vendor":"siemens","product":"ruggedcom_rst2428p_firmware","name":"ruggedcom rst2428p firmware","label":"ruggedcom_rst2428p_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0","eol":null,"hubHref":"/vendor/siemens/ruggedcom_rst2428p"},{"vendor":"xmlsoft","product":"libxml2","name":"libxml2","label":"libxml2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 2.15.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.2","eol":null,"hubHref":"/vendor/xmlsoft/libxml2"}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://vuldb.com/?id.319228","label":"vuldb.com?id.319228","hostname":"vuldb.com","tags":["VDB Entry","Technical Description","Permissions Required","Third Party Advisory"]},{"url":"https://vuldb.com/?ctiid.319228","label":"vuldb.com?ctiid.319228","hostname":"vuldb.com","tags":["Signature","Permissions Required","Third Party Advisory"]},{"url":"https://vuldb.com/?submit.622285","label":"vuldb.com?submit.622285","hostname":"vuldb.com","tags":["Third Party Advisory","Permissions Required"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/958","label":"gitlab.gnome.org/GNOME/libxml2/-/issues/958","hostname":"gitlab.gnome.org","tags":["Issue Tracking","Exploit","Third Party Advisory"]},{"url":"https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853","label":"gitlab.gnome.org/GNOME/libxml2/-/issues/958","hostname":"gitlab.gnome.org","tags":["Issue Tracking","REPORT","Exploit","Third Party Advisory"]},{"url":"https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link","label":"drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link","hostname":"drive.google.com","tags":["Exploit","REPORT","Broken Link"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","label":"cert-portal.siemens.com/productcert/html/ssa-253495.html","hostname":"cert-portal.siemens.com","tags":["Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-8732","label":"ubuntu.com/security/CVE-2025-8732","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8732","label":"www.cve.org/CVERecord?id=CVE-2025-8732","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7974-1","label":"ubuntu.com/security/notices/USN-7974-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-8732","label":"security-tracker.debian.org/tracker/CVE-2025-8732","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8732","label":"nvd.nist.gov/vuln/detail/CVE-2025-8732","hostname":"nvd.nist.gov","tags":["Oval","Advisory"]}],"lineage":{"upstream":[],"downstream":["MGASA-2026-0027","OPENSUSE-SU-2026:10213-1","OPENSUSE-SU-2026:20312-1","SUSE-SU-2025:4104-1","SUSE-SU-2025:4115-1","SUSE-SU-2025:4116-1","SUSE-SU-2026:0570-1","SUSE-SU-2026:0605-1","SUSE-SU-2026:20631-1","SUSE-SU-2026:20647-1","SUSE-SU-2026:20657-1","SUSE-SU-2026:20707-1"],"duplicates":[],"related":["OPENSUSE-SU-2026:10213-1","OPENSUSE-SU-2026:20312-1","SUSE-SU-2025:4104-1","SUSE-SU-2025:4115-1","SUSE-SU-2025:4116-1","SUSE-SU-2026:0570-1","SUSE-SU-2026:0605-1","SUSE-SU-2026:20631-1","SUSE-SU-2026:20647-1","SUSE-SU-2026:20657-1","SUSE-SU-2026:20707-1","USN-7974-1"]},"timeline":[{"kind":"published","date":"2025-08-08T16:32:06.990Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-02T12:59:45.337Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:28:23.671Z","stale":false,"partial":false}}