CVE-2025-8732
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
A vulnerability was found in libxml2 up to version 2.14.5, involving uncontrolled recursion in the xmlParseSGMLCatalog function of the xmlcatalog component. The attack requires local access and can be triggered with untrusted SGML catalogs.
Risk Assessment
The risk for the organization is low, as the attack requires local access and the use of untrusted SGML catalogs, which are rarely used. The vulnerability could lead to system overload (DoS) if malicious catalogs are intentionally used.
Recommendation
It is recommended to update libxml2 to version 2.14.6 or later if available. If updating is not possible, avoid using untrusted SGML catalogs and restrict local access to the system.
Original NVD description (English source)
A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The code maintainer explains, that "[t]he issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. I also doubt that anyone is still using SGML catalogs at all."