CVE-2026-25210

MEDIUM

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

CVSS v3.1 Score

6.9
MEDIUM
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack Vector
LOCAL
Complexity
HIGH
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW
Published: 1/30/2026Modified: 6/17/2026

Related Intelligence (2)

CRITICALVulnerability

Siemens SINEC OS

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.</strong></p> <p>The following versions of Siemens SINEC OS are affected:

CVE-2025-1352CVE-2025-1376
CISA Advisories
CRITICALVulnerability

Hitachi Energy RTU500

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-155-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. If exploited, these vulnerabilities primarily impact product availability, with potential secondary impacts on confidentiality and

CVE-2025-69421CVE-2026-24515
CISA Advisories

References (3)

https://github.com/libexpat/libexpat/pull/1075Issue TrackingPatchhttps://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7Patchhttps://cert-portal.siemens.com/productcert/html/ssa-253495.html