# CVE-2025-66382: libexpat inefficient algorithmic complexity denial of service

Source: https://junglewise.ai/threats/cve-2025-66382-libexpat-inefficient-algorithmic-complexity-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-28. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2025-66382 · Severity: low · CVSS 2.9 · Published 2025-11-28

libexpat is a widely used software library for processing XML data, found in many operating systems and industrial devices. A vulnerability has been identified where a specially crafted, relatively small file (approx. 2 MiB) can cause the library to consume excessive processing time. This can lead to a denial-of-service condition, making the affected application or device unresponsive for significant periods, potentially disrupting business operations or industrial processes.

Technologies: [Libexpat Project Libexpat](https://junglewise.ai/threats/technologies/libexpat), [Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-1518-4-pn-dp-mfp), [Siemens SIMATIC S7-1500 CPU family](https://junglewise.ai/threats/technologies/simatic-s7-1500-cpu-family), [Siemens SINEC OS (RUGGEDCOM RST2428P)](https://junglewise.ai/threats/technologies/sinec-os). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-66382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66382 being exploited in the wild.

**How severe is CVE-2025-66382?** Low severity, with a CVSS score of 2.9, published 28 November 2025.

**Which products and versions are affected?** Libexpat Project Libexpat up to and including 2.7.3; libexpat Project libexpat up to and including 2.7.3; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP All versions >= V3.1.5; Siemens SIMATIC S7-1500 CPU family versions >= V3.1.5; and 1 more.

**Is there a fix for CVE-2025-66382?** A patch was published on 2026-06-02: Siemens released SINEC OS V4.0 containing a fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66382 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-66382?** Check whether you run Libexpat Project Libexpat, libexpat Project libexpat, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in libexpat through version 2.7.3 due to inefficient algorithmic complexity (CWE-407) when parsing certain XML structures. An attacker can provide a crafted XML file of approximately 2 MiB that requires 25 to 100 seconds of CPU time to process, depending on the hardware. This local attack vector typically requires a user to open the malicious file or for an application to process untrusted input using the library. While NVD assigned a medium severity (5.5) based on high availability impact, the vendor (MITRE) initially reported it as low (2.9). Siemens has acknowledged impact on SIMATIC S7-1500 and SINEC OS products. As of the advisory date, a formal patch in the libexpat master branch was still pending.

## Affected products

- libexpat project libexpat up to and including 2.7.3
- Siemens SIMATIC S7-1500 CPU family versions >= V3.1.5
- Siemens SINEC OS (RUGGEDCOM RST2428P) versions < V4.0

## Timeline

- 2025-09-25: other: Vulnerability reported to developers by a researcher
- 2025-10-04: other: Public issue opened on GitHub tracking the flaw
- 2025-11-28: disclosed: CVE published
- 2026-06-02: patched: Siemens released SINEC OS V4.0 containing a fix

## References

- [https://github.com/libexpat/libexpat/issues/1076](https://github.com/libexpat/libexpat/issues/1076)
- [http://www.openwall.com/lists/oss-security/2025/12/02/1](http://www.openwall.com/lists/oss-security/2025/12/02/1)
- [https://cert-portal.siemens.com/productcert/html/ssa-082556.html](https://cert-portal.siemens.com/productcert/html/ssa-082556.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)

## Related threats

- [Siemens SIMATIC S7-1500 XSS in trace file import](https://junglewise.ai/threats/cve-2026-63354-affected-devices-do-not-properly-validate-and-sanitize-visual)
- [Siemens SIMATIC S7 PLC web server arbitrary code execution via malicious trace files](https://junglewise.ai/threats/cve-2026-63350-affected-devices-do-not-properly-restrict-executable-content)
- [libexpat use-after-free in custom encoding callbacks](https://junglewise.ai/threats/cve-2026-76957-libexpat-use-after-free-in-custom-encoding-callbacks)
- [libexpat hash flooding denial of service via mishandled entropy generation](https://junglewise.ai/threats/cve-2026-76956-libexpat-hash-flooding-denial-of-service-via-mishandled-entropy)
- [Expat XML parser denial of service via quadratic complexity](https://junglewise.ai/threats/cve-2026-66046-expat-xml-parser-denial-of-service-via-quadratic-complexity)