CVE-2025-66382: libexpat inefficient algorithmic complexity denial of service

CVE-2025-66382 · Severity: low · CVSS 2.9 · Published 2025-11-28

libexpat is a widely used software library for processing XML data, found in many operating systems and industrial devices. A vulnerability has been identified where a specially crafted, relatively small file (approx. 2 MiB) can cause the library to consume excessive processing time. This can lead to a denial-of-service condition, making the affected application or device unresponsive for significant periods, potentially disrupting business operations or industrial processes.

Technologies: Libexpat Project Libexpat, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU family, Siemens SINEC OS (RUGGEDCOM RST2428P). Vendors: Libexpat Project, Siemens.

Quick answers

Is CVE-2025-66382 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-66382 being exploited in the wild.
How severe is CVE-2025-66382?
Low severity, with a CVSS score of 2.9, published 28 November 2025.
Which products and versions are affected?
Libexpat Project Libexpat up to and including 2.7.3; libexpat Project libexpat up to and including 2.7.3; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP All versions >= V3.1.5; Siemens SIMATIC S7-1500 CPU family versions >= V3.1.5; and 1 more.
Is there a fix for CVE-2025-66382?
A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 containing a fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66382 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2025-66382?
Check whether you run Libexpat Project Libexpat, libexpat Project libexpat, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in libexpat through version 2.7.3 due to inefficient algorithmic complexity (CWE-407) when parsing certain XML structures. An attacker can provide a crafted XML file of approximately 2 MiB that requires 25 to 100 seconds of CPU time to process, depending on the hardware. This local attack vector typically requires a user to open the malicious file or for an application to process untrusted input using the library. While NVD assigned a medium severity (5.5) based on high availability impact, the vendor (MITRE) initially reported it as low (2.9). Siemens has acknowledged impact on SIMATIC S7-1500 and SINEC OS products. As of the advisory date, a formal patch in the libexpat master branch was still pending.

Affected products

  • libexpat project libexpat up to and including 2.7.3
  • Siemens SIMATIC S7-1500 CPU family versions >= V3.1.5
  • Siemens SINEC OS (RUGGEDCOM RST2428P) versions < V4.0

Timeline

  • 2025-09-25: other: Vulnerability reported to developers by a researcher
  • 2025-10-04: other: Public issue opened on GitHub tracking the flaw
  • 2025-11-28: disclosed: CVE published
  • 2026-06-02: patched: Siemens released SINEC OS V4.0 containing a fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.