7.5
High
CVE-2025-59375 libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is…
Description
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libexpat 2.7 | earliest → < 2.7.2 | 2.7.2 |
| RUGGEDCOM RST2428P 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XCH328 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XCM324 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XCM328 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XCM332 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRH334 (24 V DC, 8xFO, CC) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (230 V AC, 12xFO) 3.3 | earliest → < 3.3 | 3.3 |
Show the 11 other branches Hide the 11 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| SCALANCE XRM334 (230 V AC, 8xFO) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (24 V DC, 12xFO) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (24 V DC, 8xFO) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (2x230 V AC, 12xFO) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (2x230 V AC, 8xFO) 3.3 | earliest → < 3.3 | 3.3 |
| SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) 3.3 | earliest → < 3.3 | 3.3 |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.5 → latest | No fix stated |
References
- github.com github.com
- github.com github.com
- github.com github.com
- issues.oss-fuzz.com issues.oss-fuzz.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of libexpat
The 26 CVEs of libexpat →
CVE-2026-76957
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks
4.9
Medium
CVE-2026-76956
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy,…
5.9
Medium
CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the…
8.7
High
CVE-2026-72522
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the…
6.2
Medium