Medium severity6.9OSV Advisory· Published Jan 30, 2026· Updated Jun 17, 2026

CVE-2026-25210

Description

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libexpat Project/LibexpatOSV3 versions
REC1_0, R_1_95_0, R_1_95_2, …+ 2 more
- (no CPE)range: REC1_0, R_1_95_0, R_1_95_2, …
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*range: <2.7.4
- (no CPE)range: <2.7.4
Siemens Foundation/libexpatllm-create
Range: <2.7.4
osv-coords16 versions
pkg:apk/chainguard/expat pkg:apk/wolfi/expat pkg:rpm/opensuse/expat&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/expat&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/expat&distro=openSUSE%20Tumbleweed pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Micro%205.2 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Micro%205.3 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Micro%205.4 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Micro%205.5 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Micro%206.0 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Micro%206.1 pkg:rpm/suse/expat&distro=SUSE%20Linux%20Micro%206.2
< 2.7.4-r0+ 15 more
- (no CPE)range: < 2.7.4-r0
- (no CPE)range: < 2.7.4-r0
- (no CPE)range: < 2.7.1-150400.3.34.1
- (no CPE)range: < 2.7.1-160000.4.1
- (no CPE)range: < 2.7.4-1.1
- (no CPE)range: < 2.7.1-150000.3.42.1
- (no CPE)range: < 2.7.1-150400.3.34.1
- (no CPE)range: < 2.7.1-150400.3.34.1
- (no CPE)range: < 2.7.1-150400.3.34.1
- (no CPE)range: < 2.7.1-150700.3.9.2
- (no CPE)range: < 2.7.1-160000.4.1
- (no CPE)range: < 2.7.1-21.49.1
- (no CPE)range: < 2.7.1-160000.4.1
- (no CPE)range: < 2.7.1-4.1
- (no CPE)range: < 2.7.1-slfo.1.1_4.1
- (no CPE)range: < 2.7.1-160000.4.1

Patches

Vulnerability mechanics

References

github.com/libexpat/libexpat/pull/1075nvdIssue TrackingPatch
github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7nvdPatch
cert-portal.siemens.com/productcert/html/ssa-253495.htmlnvd

News mentions

Siemens SINEC OS
CISA ICS Advisories
Hitachi Energy RTU500
CISA ICS Advisories

cvss	0.449
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000