Riskcovery

CVE-2025-8732

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

State
Published
Severity
4.8 Medium
Published
Aug 8, 2025
Updated
Jun 2, 2026
Reserved
Aug 8, 2025

Read the record on cve.org

Description

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."

Scores

CVSSScoreVectorSource
4.04.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.13.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:CVulDB
3.03.3 LowCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:CVulDB
2.01.7 LowAV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
libxml2n/a
  • 2.14.0Affected
  • 2.14.1Affected
  • 2.14.2Affected
  • 2.14.3Affected
  • 2.14.4Affected
  • 2.14.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.