CVE-2026-25210

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25210
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25210.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-25210
Downstream
Related
Published
2026-01-30T07:16:15.570Z
Modified
2026-03-20T12:47:56.509768Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

References

Affected packages

Git / github.com/libexpat/libexpat

Affected ranges

Type
GIT
Repo
https://github.com/libexpat/libexpat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f5c2890d8ff91f88a018173d293a9bd02f76389e
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.7.4"
        }
    ]
}

Affected versions

Other
REC1_0
R_1_95_0
R_1_95_2
R_1_95_3
R_1_95_4
R_1_95_5
R_1_95_6
R_1_95_7
R_1_95_8
R_2_0_0
R_2_0_1
R_2_1_0
R_2_1_1
R_2_2_0
R_2_2_1
R_2_2_10
R_2_2_2
R_2_2_3
R_2_2_4
R_2_2_5
R_2_2_6
R_2_2_7
R_2_2_8
R_2_2_9
R_2_3_0
R_2_4_0
R_2_4_1
R_2_4_2
R_2_4_3
R_2_4_4
R_2_4_5
R_2_4_6
R_2_4_7
R_2_4_8
R_2_4_9
R_2_5_0
R_2_6_0
R_2_6_1
R_2_6_2
R_2_6_3
R_2_6_4
R_2_7_0
R_2_7_1
R_2_7_2
R_2_7_3
V1990307
V19981122
V19981231
V19990109
V19990425
V19990626
V19990709
V19990728
V19991013
V1_0
V1_1
V20000512
beta2
beta3
beta4
jclark-orig
libexpat-alpha-1
sourceforge_init
start

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-25210.json"