High severity · published Jan 30, 2026
CVE-2026-25210
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libexpat · libexpat project
before 2.7.4 · source: vendor, NVD
RR
RUGGEDCOM RST2428P · Siemens
before V4.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25210
Issue Tracking
https://github.com/libexpat/libexpat/pull/1075
Patch
https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
More from libexpat
9.8
CVE-2024-45492
An issue was discovered in libexpat before 2.6.3
9.8
CVE-2024-45491
An issue was discovered in libexpat before 2.6.3
9.8
CVE-2022-25315
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames
9.8
CVE-2022-25235
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context
9.8
CVE-2022-25236
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs