Executive brief
Expat (libexpat) is a widely used open-source library for parsing XML data in various software applications. A vulnerability in this library allows an attacker to crash an application or cause a denial-of-service by sending a specially crafted, small XML document that forces the system to exhaust its memory. This could lead to service outages or application instability in any software that relies on Expat for processing XML input.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in libexpat before version 2.7.2. The flaw allows a remote, unauthenticated attacker to trigger disproportionately large dynamic memory allocations by providing a small, specially crafted XML document for parsing. This can lead to an out-of-memory (OOM) condition and subsequent denial-of-service (DoS). The issue was identified via OSS-Fuzz (finding 439133977) and specifically affects the XML parsing logic. Users should update to Expat 2.7.2 or later to mitigate this risk.
Affected products
- libexpat project Expat (libexpat) before 2.7.2
Timeline
- 2025-08-16: other: Issue reported upstream via OSS-Fuzz finding
- 2025-09-14: advisory: Initial CVE publication
- 2025-09-15: disclosed: Public disclosure of the vulnerability
- 2025-09-15: patched: Fixed in Expat version 2.7.2
References
- https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes
- https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes
- https://github.com/libexpat/libexpat/issues/1018
- https://github.com/libexpat/libexpat/pull/1034
- https://issues.oss-fuzz.com/issues/439133977
- http://www.openwall.com/lists/oss-security/2025/09/16/2
- http://www.openwall.com/lists/oss-security/2026/05/01/5