Integer overflow in expat - CVE-2026-25210

Vulnerability identifier: #VU122268

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-25210

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the doContent() function. A remote attacker can pass specially crafted XML data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

expat
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
OpenBSD
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
Communications Unified Assurance
iDRAC9
LANTIME Operating System Firmware (LTOS)
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
Tenable Nessus
Oracle Outside In Technology
Encryption Admin Utilities
libxmltok (Ubuntu package)
expat (Ubuntu package)
expat
expat-debuginfo
expat-debugsource
expat-devel
expat-help
expat-doc
expat-static
libexpat1-32bit
libexpat-devel
libexpat1-debuginfo
libexpat1
libexpat1-debuginfo-32bit
expat-debuginfo-32bit
libexpat-devel-32bit
expat-32bit-debuginfo
libexpat1-32bit-debuginfo
libexpat-devel-64bit
libexpat1-64bit
expat-64bit-debuginfo
libexpat1-64bit-debuginfo
Integrated System for Microsoft Azure Stack Hub

Install updates from vendor's website.

expat - update to 2.7.4
iDRAC9 - addressed in versions 7.00.00.184, 7.30.30.51
LANTIME Operating System Firmware (LTOS) - update to 7.10.009
Tenable Nessus - addressed in versions 10.10.2, 10.11.2
libxmltok (Ubuntu package) - addressed in versions 1.2-3ubuntu0.16.04.1~esm5, 1.2-4ubuntu0.18.04.1~esm6, 1.2-4ubuntu0.20.04.1~esm6, 1.2-4ubuntu0.22.04.1~esm6, 1.2-4.1ubuntu2.24.0.4.1+esm4
expat (Ubuntu package) - addressed in versions 2.1.0-4ubuntu1.4+esm11, 2.1.0-7ubuntu0.16.04.5+esm11, 2.2.5-3ubuntu0.9+esm3, 2.2.9-1ubuntu0.8+esm1, 2.4.7-1ubuntu0.7, 2.6.1-2ubuntu0.4, 2.7.1-2ubuntu0.2
expat - addressed in versions 2.2.9-21, 2.4.1-21, 2.5.0-15
expat-debuginfo - addressed in versions 2.2.9-21, 2.4.1-21, 2.5.0-15
expat-debugsource - addressed in versions 2.2.9-21, 2.4.1-21, 2.5.0-15
expat-devel - addressed in versions 2.2.9-21, 2.4.1-21, 2.5.0-15
expat-help - addressed in versions 2.2.9-21, 2.4.1-21, 2.5.0-15
expat-doc - update to 2.5.0-9
expat-static - update to 2.5.0-9
expat-devel - update to 2.5.0-9
expat - update to 2.5.0-9
libexpat1-32bit - addressed in versions 2.7.1-21.49.1, 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
libexpat-devel - addressed in versions 2.7.1-21.49.1, 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
expat - addressed in versions 2.7.1-21.49.1, 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
libexpat1-debuginfo - addressed in versions 2.7.1-21.49.1, 2.7.1-150000.3.42.1, 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
expat-debuginfo - addressed in versions 2.7.1-21.49.1, 2.7.1-150000.3.42.1, 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
libexpat1 - addressed in versions 2.7.1-21.49.1, 2.7.1-150000.3.42.1, 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
expat-debugsource - addressed in versions 2.7.1-21.49.1, 2.7.1-150000.3.42.1, 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
libexpat1-debuginfo-32bit - update to 2.7.1-21.49.1
expat-debuginfo-32bit - update to 2.7.1-21.49.1
libexpat-devel-32bit - update to 2.7.1-150400.3.34.1
expat-32bit-debuginfo - addressed in versions 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
libexpat1-32bit-debuginfo - addressed in versions 2.7.1-150400.3.34.1, 2.7.1-150700.3.9.2
libexpat-devel-64bit - update to 2.7.1-150400.3.34.1
libexpat1-64bit - update to 2.7.1-150400.3.34.1
expat-64bit-debuginfo - update to 2.7.1-150400.3.34.1
libexpat1-64bit-debuginfo - update to 2.7.1-150400.3.34.1
Encryption Admin Utilities - update to 11.13.1
Integrated System for Microsoft Azure Stack Hub - update to 2606

• https://github.com/libexpat/libexpat/pull/1075
• https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7

• Multiple vulnerabilities in libexpat
• SUSE update for expat
• Tenable Nessus update for third-party components
• Anolis OS update for expat
• openEuler 24.03 LTS SP1 update for expat
• openEuler 24.03 LTS update for expat
• openEuler 20.03 LTS SP4 update for expat
• openEuler 24.03 LTS SP3 update for expat
• OpenBSD update for libexpat
• Ubuntu update for expat
• Ubuntu update for libxmltok
• openEuler 22.03 LTS SP4 update for expat
• openEuler 24.03 LTS SP2 update for expat
• Ubuntu update for expat
• SUSE update for expat
• SUSE update for expat
• SUSE update for expat
• Meinberg LANTIME firmware update for third-party components
• Multiple vulnerabilities in Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Outside In Technology
• Multiple vulnerabilities in Dell iDRAC9
• Multiple vulnerabilities in Dell Integrated System for Microsoft Azure Stack Hub 14G and 16G
• Multiple vulnerabilities in Dell Encryption