CVE-2025-59375

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-25)

CWE

CWE-770

Published

2025-09-15

Modified

2026-10-19

Record from

the NVD, synced 2026-10-19

Affected

• libexpat_project:libexpat

References

• https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
• https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes
• https://github.com/libexpat/libexpat/issues/1018
• https://github.com/libexpat/libexpat/pull/1034
• https://issues.oss-fuzz.com/issues/439133977

Check your stackJSON