CVE-2026-25210
Medium · 6.9CVSS
6.9
EPSS
0.2%
Published
Jan 30, 2026
CISA due date
—
The record
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | expat | 0 | 2.7.4-1.mga9 |
| SUSE:Linux Enterprise Micro 5.3 | expat | 0 | 2.7.1-150400.3.34.1 |
| SUSE:Linux Enterprise Micro 5.4 | expat | 0 | 2.7.1-150400.3.34.1 |
| SUSE:Linux Enterprise Micro 5.5 | expat | 0 | 2.7.1-150400.3.34.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | expat | 0 | 2.7.1-150700.3.9.2 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | expat | 0 | 2.7.1-21.49.1 |
| openSUSE:Leap 15.6 | expat | 0 | 2.7.1-150400.3.34.1 |
| openSUSE:Leap 16.0 | expat | 0 | 2.7.1-160000.4.1 |
| openSUSE:Tumbleweed | expat | 0 | 2.7.4-1.1 |
Related vulnerabilities
- CVE-2026-24515 In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding… Also affects expat
- CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. Also affects expat
- CVE-2024-45491 An issue was discovered in libexpat before 2.6.3. Also affects expat
- CVE-2024-45492 An issue was discovered in libexpat before 2.6.3. Also affects expat
- CVE-2024-45490 An issue was discovered in libexpat before 2.6.3. Also affects expat
- CVE-2024-28757 libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use… Also affects expat
- CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter… Also affects expat
- CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content. Also affects expat