CVE-2025-59375: libexpat Expat resource exhaustion in XML parsing

CVE-2025-59375 · Severity: high · CVSS 7.5 · Published 2025-09-15

Expat (libexpat) is a widely used open-source library for parsing XML data in various software applications. A vulnerability in this library allows an attacker to crash an application or cause a denial-of-service by sending a specially crafted, small XML document that forces the system to exhaust its memory. This could lead to service outages or application instability in any software that relies on Expat for processing XML input.

Technologies: Libexpat Project Expat, Libexpat Project Libexpat. Vendors: Libexpat Project.

Quick answers

Is CVE-2025-59375 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-59375 being exploited in the wild.
How severe is CVE-2025-59375?
High severity, with a CVSS score of 7.5, published 15 September 2025.
Which products and versions are affected?
Libexpat Project Expat before 2.7.2.
Is there a fix for CVE-2025-59375?
A patch was published on 2025-09-15: Fixed in Expat version 2.7.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-59375 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-59375?
Check whether you run Libexpat Project Expat or Libexpat Project Libexpat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in libexpat before version 2.7.2. The flaw allows a remote, unauthenticated attacker to trigger disproportionately large dynamic memory allocations by providing a small, specially crafted XML document for parsing. This can lead to an out-of-memory (OOM) condition and subsequent denial-of-service (DoS). The issue was identified via OSS-Fuzz (finding 439133977) and specifically affects the XML parsing logic. Users should update to Expat 2.7.2 or later to mitigate this risk.

Affected products

  • libexpat project Expat (libexpat) before 2.7.2

Timeline

  • 2025-08-16: other: Issue reported upstream via OSS-Fuzz finding
  • 2025-09-14: advisory: Initial CVE publication
  • 2025-09-15: disclosed: Public disclosure of the vulnerability
  • 2025-09-15: patched: Fixed in Expat version 2.7.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.