Is CVE-2025-8732 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8732 being exploited in the wild.

How severe is CVE-2025-8732?

Low severity, with a CVSS score of 3.3, published 8 August 2025.

Which products and versions are affected?

Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.

Is there a fix for CVE-2025-8732?

A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 addressing the issue in affected RUGGEDCOM products. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-8732 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-8732?

Check whether you run Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8732: GNOME libxml2 uncontrolled recursion in xmlParseSGMLCatalog

CVE-2025-8732 · Severity: low · CVSS 3.3 · Published 2025-08-08

A vulnerability exists in libxml2, a widely used library for processing XML and SGML data. An attacker with local access to a system could provide a specially crafted catalog file that causes the software to crash by entering an infinite loop. While this could lead to a denial of service, the impact is considered low because it requires the use of outdated SGML catalog features and untrusted configuration files.

Technologies: Siemens RUGGEDCOM RST2428P, Siemens SINEC OS. Vendors: Siemens.

Quick answers

Is CVE-2025-8732 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8732 being exploited in the wild.
How severe is CVE-2025-8732?: Low severity, with a CVSS score of 3.3, published 8 August 2025.
Which products and versions are affected?: Siemens RUGGEDCOM RST2428P before V4.0; Siemens SINEC OS before V4.0.
Is there a fix for CVE-2025-8732?: A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 addressing the issue in affected RUGGEDCOM products. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-8732 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-8732?: Check whether you run Siemens RUGGEDCOM RST2428P or Siemens SINEC OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in libxml2 (up to version 2.14.5) involves uncontrolled recursion within the xmlParseSGMLCatalog function of the xmlcatalog component. The issue is caused by missing cycle detection when a catalog file contains a CATALOG directive that points back to itself, leading to mutual recursion between xmlExpandCatalog and xmlParseSGMLCatalog. A local attacker can exploit this by providing a malicious SGML catalog file, resulting in a stack overflow and subsequent segmentation fault (Denial of Service). The maintainers have disputed the practical impact, noting that SGML catalogs are largely obsolete and should not be loaded from untrusted sources. Siemens has addressed this in SINEC OS V4.0.

Affected products

GNOME libxml2 up to 2.14.5
Siemens SINEC OS before V4.0
Siemens RUGGEDCOM RST2428P before V4.0

Timeline

2025-08-08: advisory: Initial disclosure of CVE-2025-8732
2026-06-02: patched: Siemens released SINEC OS V4.0 addressing the issue in affected RUGGEDCOM products.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.