CVE-2025-59375
High7.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
- CVSS
- 7.5v3.1
- EPSS (exploit probability)
- 1.3%70th pct
- CISA KEV
- Not listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-20 | 1.3% | 70.3% |
| 2026-10-19 | 1.3% | 70.3% |
| 2026-10-18 | 1.3% | 70.3% |
| 2026-10-16 | 1.3% | 70.3% |
| 2026-10-15 | 1.3% | 70.2% |
| 2026-10-14 | 1.3% | 70.2% |
| 2026-10-13 | 1.3% | 70.0% |
| 2026-10-12 | 1.3% | 70.0% |
| 2026-10-11 | 1.3% | 70.0% |
| 2026-10-10 | 1.3% | 69.9% |
| 2026-10-09 | 1.3% | 69.9% |
| 2026-10-08 | 1.3% | 69.9% |
| 2026-10-07 | 1.3% | 69.9% |
| 2026-10-06 | 1.3% | 69.8% |
| 2026-10-05 | 1.3% | 69.8% |
| 2026-10-04 | 1.3% | 69.8% |
| 2026-10-03 | 1.3% | 69.8% |
| 2026-10-02 | 1.3% | 69.7% |
| 2026-10-01 | 1.3% | 69.7% |
| 2026-09-30 | 1.3% | 69.7% |
| 2026-09-29 | 1.3% | 69.6% |
| 2026-09-27 | 1.3% | 69.6% |
| 2026-09-26 | 1.3% | 69.6% |
| 2026-09-25 | 1.3% | 69.5% |
| 2026-09-24 | 1.3% | 69.5% |
| 2026-09-23 | 1.3% | 69.5% |
| 2026-09-22 | 1.3% | 69.5% |
| 2026-09-21 | 1.3% | 69.1% |
| 2026-09-20 | 1.3% | 69.5% |
| 2026-09-19 | 1.3% | 69.5% |
| 2026-09-18 | 1.3% | 69.4% |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
- libexpat project libexpat
Coverage1 article
References
- https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
- https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes
- https://github.com/libexpat/libexpat/issues/1018
- https://github.com/libexpat/libexpat/pull/1034
- https://issues.oss-fuzz.com/issues/439133977
- http://www.openwall.com/lists/oss-security/2025/09/16/2
- http://www.openwall.com/lists/oss-security/2026/05/01/5
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html