# CVE-2026-25210: libexpat integer overflow in doContent tag buffer reallocation

Source: https://junglewise.ai/threats/cve-2026-25210-libexpat-integer-overflow-in-docontent-tag-buffer-reallocation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-30. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-25210 · Severity: medium · CVSS 6.9 · Published 2026-01-30

libexpat is a widely used library for parsing XML data, integrated into many operating systems and industrial networking products like Siemens RUGGEDCOM switches. A vulnerability in how the library handles memory during data processing could allow an attacker to cause system crashes or potentially gain unauthorized access to sensitive information. This could impact the reliability of industrial network equipment and the confidentiality of the data they process.

Technologies: [Libexpat Project Expat](https://junglewise.ai/threats/technologies/expat), [Libexpat Project Libexpat](https://junglewise.ai/threats/technologies/libexpat), [Siemens RUGGEDCOM RST2428P](https://junglewise.ai/threats/technologies/ruggedcom-rst2428p), [Siemens SINEC OS](https://junglewise.ai/threats/technologies/sinec-os). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-25210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25210 being exploited in the wild.

**How severe is CVE-2026-25210?** Medium severity, with a CVSS score of 6.9, published 30 January 2026.

**Which products and versions are affected?** Libexpat Project Expat versions before 2.7.4; Siemens RUGGEDCOM RST2428P all versions before V4.0; Siemens SINEC OS versions before V4.0.

**Is there a fix for CVE-2026-25210?** A patch was published on 2025-10-03: Fix merged into libexpat master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25210 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-25210?** Check whether you run Libexpat Project Expat, Libexpat Project Libexpat, Siemens RUGGEDCOM RST2428P or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability (CWE-190) exists in libexpat's xmlparse.c within the doContent function. The flaw occurs because the code lacks a proper check for integer overflow when calculating the new buffer size (bufSize) during tag buffer reallocation. Specifically, the calculation `(size_t)(tag->bufEnd - tag->buf) * 2` can wrap around if the buffer is sufficiently large. An attacker with local access could exploit this to cause a heap-based buffer overflow, leading to memory corruption, information disclosure, or denial of service. The issue is addressed in libexpat version 2.7.4 by introducing a check against SIZE_MAX before doubling the buffer size.

## Affected products

- libexpat project libexpat versions before 2.7.4
- Siemens SINEC OS versions before V4.0
- Siemens RUGGEDCOM RST2428P all versions before V4.0

## Timeline

- 2025-10-03: patched: Fix merged into libexpat master branch
- 2026-01-30: disclosed: CVE published to NVD
- 2026-06-02: advisory: Siemens released advisory SSA-253495 covering this CVE in SINEC OS products

## References

- [https://github.com/libexpat/libexpat/pull/1075](https://github.com/libexpat/libexpat/pull/1075)
- [https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7](https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)

## Related threats

- [libexpat use-after-free in custom encoding callbacks](https://junglewise.ai/threats/cve-2026-76957-libexpat-use-after-free-in-custom-encoding-callbacks)
- [libexpat hash flooding denial of service via mishandled entropy generation](https://junglewise.ai/threats/cve-2026-76956-libexpat-hash-flooding-denial-of-service-via-mishandled-entropy)
- [Expat XML parser denial of service via quadratic complexity](https://junglewise.ai/threats/cve-2026-66046-expat-xml-parser-denial-of-service-via-quadratic-complexity)
- [libexpat use-after-free in doCdataSection](https://junglewise.ai/threats/cve-2026-56412-libexpat-use-after-free-in-docdatasection)
- [libexpat integer overflow in xmlwf endDoctypeDecl](https://junglewise.ai/threats/cve-2026-56411-libexpat-integer-overflow-in-xmlwf-enddoctypedecl)