CVE-2026-25210
Integer Overflow in libexpat doContent Causes Buffer Overflow
Publication date: 2026-01-30
Last updated on: 2026-03-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libexpat_project | libexpat | to 2.7.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-190 | The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in libexpat before version 2.7.4 occurs because the doContent function does not properly check for integer overflow when calculating the buffer size (bufSize) for tag buffer reallocation. Without this check, the buffer size calculation can overflow, potentially leading to incorrect memory allocation and related errors. [1]
How can this vulnerability impact me? :
The vulnerability can lead to memory allocation errors due to integer overflow during buffer size calculation. This can cause buffer overflows or other memory safety issues, potentially allowing an attacker with local access to cause denial of service or compromise the integrity and confidentiality of data processed by libexpat. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update libexpat to version 2.7.4 or later where the integer overflow check for buffer reallocation in the doContent function has been implemented. This update includes a fix that prevents integer overflow by verifying buffer size before reallocation, improving memory safety. [1]