Logo
›
›vulnerability›CVE-2025-59375
Name
CVE-2025-59375
Source
NVD ( link)Debian ( link)
Description
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CWEs
CWE-770
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74Product
https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/ChangesProduct
https://github.com/libexpat/libexpat/issues/1018Exploit
https://github.com/libexpat/libexpat/pull/1034Issue Tracking
https://issues.oss-fuzz.com/issues/439133977Exploit

Analysis#

Affected Component
Analysis
expat
Exploitable

Vulnerability Ratings#

7.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
expat
buildroot
2025.02.x
2.8.1
Not Affected
expat
buildroot
master
2.8.1
Not Affected
expat
openwrt
master
2.8.1-r1
Not Affected
expat
openwrt
openwrt-25.12
2.8.1-r1
Not Affected
expat
yocto
master
2.8.1
Not Affected
expat
yocto
scarthgap
2.6.4
Patched

Resolved with patches#

expat (yocto:scarthgap)

#
Title
Author
Resolve
1
lib: Make function copyString use macro MALLOC
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
2
Changes: Document allocation tracking
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
3
lib: Exclude the content model from allocation tracking
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
4
Changes: Document pull request #1047
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
5
lib: Document and regression-proof absence of integer
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
6
lib: Make function dtdCreate use macro MALLOC
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
7
lib: Exclude XML_Mem* functions from allocation tracking
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
8
xmlwf: Mention supported environment variables in --help
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
9
lib: Drop casts around malloc/realloc returns that C99 does
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
10
tests: Fix test guard for test related to allocation tracking
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
11
tests: Cover allocation tracking and limiting with tests
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
12
lib: Make string pools use macros MALLOC, FREE, REALLOC
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
13
fuzz: Be robust towards NULL return from
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
14
xmlwf: Wire allocation tracker config to existing arguments
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
15
lib: Make function dtdDestroy use macro FREE
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
16
docs: Promote the contract to call XML_FreeContentModel
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
17
lib: Implement tracking of dynamic memory allocations
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
18
lib: Exclude the main input buffer from allocation tracking
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
19
lib: Make function hash tables use macros MALLOC and FREE
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
20
tests: Add new test test_alloc_tracker_pointer_alignment
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
21
lib: Make XML_MemFree and XML_FreeContentModel match their
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
22
lib: Make function dtdReset use macro FREE
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
23
docs: Document the two allocation tracking API functions
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
24
lib: Fix alignment of internal allocations for some non-amd64
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375
25
lib: Make function dtdCopy use macro MALLOC
Sebastian Pipping <sebastian@pipping.org>
CVE-2025-59375