High severity · published Sep 15, 2025
CVE-2025-59375
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libexpat · libexpat project
before 2.7.2 · source: vendor, NVD
RR
RUGGEDCOM RST2428P · Siemens
before V3.3 · source: CISA
SX
SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCH328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM324 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM328 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XCM332 · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRH334 (24 V DC, 8xFO, CC) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 12xFO) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230 V AC, 8xFO) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) · Siemens
before V3.3 · source: CISA
SX
SCALANCE XRM334 (24 V DC, 12xFO) · Siemens
before V3.3 · source: CISA
In the news
VulnerabilityHigh
Siemens SINEC OS
View CSAF
Summary
SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
The following versions of Siemens SINEC OS are affected:
RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375)
SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...
Feb 12, 2026·CISA Advisories
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59375
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59375
Product
https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
Product
https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes
Exploit
https://github.com/libexpat/libexpat/issues/1018
Issue Tracking
https://github.com/libexpat/libexpat/pull/1034
Exploit
https://issues.oss-fuzz.com/issues/439133977
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/09/16/2
More from libexpat
9.8
CVE-2024-45492
An issue was discovered in libexpat before 2.6.3
9.8
CVE-2024-45491
An issue was discovered in libexpat before 2.6.3
9.8
CVE-2022-25315
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames
9.8
CVE-2022-25235
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context
9.8
CVE-2022-25236
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs