---
title: CVE-2025-8732
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2025-8732
---

# CVE-2025-8732

Publication date 8 August 2025

Last updated 11 September 2026

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/CVE-2025-8732#priority-reason )

## Cvss 3 Severity Score

**3.3 · Low**

[Score breakdown](https://ubuntu.com/security/CVE-2025-8732#impact-score)

Toggle side navigation

## Description

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as
problematic. This vulnerability affects the function xmlParseSGMLCatalog of
the component xmlcatalog. The manipulation leads to uncontrolled recursion.
Attacking locally is a requirement. The exploit has been disclosed to the
public and may be used. The real existence of this vulnerability is still
doubted at the moment. The code maintainer explains, that "[t]he issue can
only be triggered with untrusted SGML catalogs and it makes absolutely no
sense to use untrusted catalogs. I also doubt that anyone is still using
SGML catalogs at all."

[Read the notes from the security team](https://ubuntu.com/security/CVE-2025-8732#notes)

### Why is this CVE low priority?

Only a recursion issue when parsing untrusted catalogs

[Learn more about Ubuntu priority](https://ubuntu.com/security/cves/about#priority)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| libxml2 | 25.10 questing | Fixed 2.14.5+dfsg-0.2ubuntu0.1 |
| 25.04 plucky | Ignored end of life, was needs-triage |
| 24.04 LTS noble | Fixed 2.9.14+dfsg-1.3ubuntu3.7 |
| 22.04 LTS jammy | Fixed 2.9.13+dfsg-1ubuntu0.11 |
| 20.04 LTS focal | Fixed 2.9.10+dfsg-5ubuntu0.20.04.10+esm4  Ubuntu Pro |
| 18.04 LTS bionic | Fixed 2.9.4+dfsg1-6.1ubuntu1.9+esm7  Ubuntu Pro |
| 16.04 LTS xenial | Fixed 2.9.3+dfsg1-1ubuntu0.7+esm12  Ubuntu Pro |
| 14.04 LTS trusty | Fixed 2.9.1+dfsg1-3ubuntu4.13+esm11  Ubuntu Pro |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2025-8732#patch-details)

### Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

[Get Ubuntu Pro](https://ubuntu.com/pro)
[30-day free trial](https://ubuntu.com/pro/free-trial)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

This is just a recursive parsing issue, and per the libxml2
developers it "can only be triggered with untrusted SGML
catalogs and it makes absolutely no sense to use untrusted
catalogs". Marking as low priority.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| libxml2 | * Upstream:   <https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/337> |

## Severity score breakdown

CVSS version:

CVSS v4.0

[CVSS v4.0](https://ubuntu.com/security/CVE-2025-8732)
[CVSS v3.0](https://ubuntu.com/security/CVE-2025-8732)

**Base score**

1.9 · Low

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Local |
  | Attack complexity | Low |
  | Attack requirements | None |
  | Privileges required | Low |
  | User interaction | None |
  | Vulnerable system - Confidentiality impact | None |
  | Vulnerable system - Integrity impact | None |
  | Vulnerable system - Availability impact | Low |
  | Subsequent system - Confidentiality impact | None |
  | Subsequent system - Integrity impact | None |
  | Subsequent system - Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 1.9 · Low |
  | Base + Threat score | - |
  | Base + Environmental score | - |
  | Base + Threat + Environmental score | - |

**Vector:** CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8732)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-8732)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2025-8732)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2025-8732)

### Related Ubuntu Security Notices (USN)

+ [USN-7974-1](https://usn.ubuntu.com/USN-7974-1)
+ libxml2 vulnerabilities
+ 22 January 2026

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2025-8732>
* <https://gitlab.gnome.org/GNOME/libxml2/-/issues/958#note_2505853>
* <https://drive.google.com/file/d/1woIeYVcSQB_NwfEhaVnX6MedpWJ_nqWl/view?usp=drive_link>