CVE-2025-59375CWE-770denial-of-service

CVE-2025-59375

High · published September 15, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
70.5
In the wild
Unconfirmed
What it is

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01315 · 70.5th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-09-15T07:15Z
Affected products (1)
ProductVersionsFixed in
libexpat_project/libexpat< 2.7.22.7.2
References (9)
https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74 · [email protected]https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes · [email protected]https://github.com/libexpat/libexpat/issues/1018 · [email protected]https://github.com/libexpat/libexpat/pull/1034 · [email protected]https://issues.oss-fuzz.com/issues/439133977 · [email protected]http://www.openwall.com/lists/oss-security/2025/09/16/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2026/05/01/5 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-082556.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-089022.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 15 SEP 00:00Z
    libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing
    cvelistv5