CVE-2025-59375

What it actually does

The vulnerability permits an attacker to cause excessive dynamic memory allocations by submitting a minimal XML document for parsing, leading to potential denial of service through resource exhaustion.

Why it matters to the business

Applications relying on libexpat for XML parsing may experience crashes or severe performance degradation, resulting in service unavailability and operational disruptions. With over 400 days since disclosure, ensure patching to maintain availability.

How an attack unfolds

An attacker crafts a small XML input designed to trigger the memory allocation flaw in libexpat's parser and submits it to any service using the vulnerable library for XML processing.

How to fix it

Upgrade libexpat to version 2.7.2 or later, specifically incorporating commit 7643f96bd5b9f5d3b26ea112519e05e17ef91cfb. Review and apply the fix in all dependent products.

How to confirm the fix worked

Verify the installed version of libexpat is 2.7.2 or higher. Test parsing of known trigger documents to ensure no excessive allocation occurs.

Typical attack path

1. Identify a target application or service that uses libexpat for parsing XML input
2. Craft a minimal malicious XML document that exploits the allocation issue
3. Submit the document to the parser via network or local input
4. Observe resource exhaustion or crash in the target process

How to detect it

Examine logs for unexpected high memory usage or crashes in processes using libexpat during XML parsing. Look for patterns of small inputs leading to large allocations, though specific signatures may not be available.

What your security team should do

• Prioritize upgrading libexpat across all affected systems
• Monitor for any unusual memory usage spikes in XML parsing processes
• Implement input validation where possible to limit XML document sizes