CVE-2026-25210

7.8 highEPSS 0.2%

High (7.8) in libexpat project libexpat. EPSS 0.2% chance of exploitation in the next 30 days.

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2026-01-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

libexpat_project:libexpat

References

https://github.com/libexpat/libexpat/pull/1075
https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7
https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Check your stack JSON