Junglewise Threat Intelligence

CVE-2025-8732: GNOME libxml2 uncontrolled recursion in xmlParseSGMLCatalog

CVE-2025-8732 · Severity: low · CVSS 3.3 · Published 2025-08-08

Technologies: Siemens RUGGEDCOM RST2428P, Siemens SINEC OS. Vendors: Siemens, Gnome.

Executive brief

A vulnerability exists in libxml2, a widely used library for processing XML and SGML data. An attacker with local access to a system could provide a specially crafted catalog file that causes the software to crash by entering an infinite loop. While this could lead to a denial of service, the impact is considered low because it requires the use of outdated SGML catalog features and untrusted configuration files.

Technical details

A vulnerability in libxml2 (up to version 2.14.5) involves uncontrolled recursion within the xmlParseSGMLCatalog function of the xmlcatalog component. The issue is caused by missing cycle detection when a catalog file contains a CATALOG directive that points back to itself, leading to mutual recursion between xmlExpandCatalog and xmlParseSGMLCatalog. A local attacker can exploit this by providing a malicious SGML catalog file, resulting in a stack overflow and subsequent segmentation fault (Denial of Service). The maintainers have disputed the practical impact, noting that SGML catalogs are largely obsolete and should not be loaded from untrusted sources. Siemens has addressed this in SINEC OS V4.0.

Affected products

  • GNOME libxml2 up to 2.14.5
  • Siemens SINEC OS before V4.0
  • Siemens RUGGEDCOM RST2428P before V4.0

Timeline

  • 2025-08-08: advisory: Initial disclosure of CVE-2025-8732
  • 2026-06-02: patched: Siemens released SINEC OS V4.0 addressing the issue in affected RUGGEDCOM products.

References

Related threats