p PatchFirst

CVE-2026-25210

CVE-2026-25210

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libexpat

    Versions
    • ≥ 0, < 2.7.4: Affected (semver)

    Update to 2.7.4

  • expat Debian:12

    Versions
    • 2.5.0-1
    • 2.5.0-1+deb12u1
    • 2.5.0-1+deb12u2
    • 2.5.0-1+deb12u3
    Affected ranges
    • ECOSYSTEM: < 2.5.0-1+deb12u4

    Update to 2.5.0-1+deb12u4

  • expat Debian:13

    Versions
    • 2.7.1-2
    • 2.7.2-1
    • 2.7.3-1
    • 2.7.3-2
    • 2.7.4-1
    • 2.7.5-1
    • 2.8.0-1
    • 2.8.0-2
    • 2.8.1-1
    Affected ranges
    • ECOSYSTEM: < 2.8.2-1~deb13u1

    Update to 2.8.2-1~deb13u1

  • expat Debian:14

    Versions
    • 2.7.1-2
    • 2.7.2-1
    • 2.7.3-1
    • 2.7.3-2
    Affected ranges
    • ECOSYSTEM: < 2.7.4-1

    Update to 2.7.4-1

  • coin3 Ubuntu:Pro:14.04:LTS

    Versions
    • 3.1.4~abc9f50-3
    • 3.1.4~abc9f50-4
    • 3.1.4~abc9f50-4ubuntu2
    • 3.1.4~abc9f50-4ubuntu2+esm1
    • 3.1.4~abc9f50-4ubuntu2+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • expat Ubuntu:Pro:14.04:LTS

    Versions
    • 2.1.0-4
    • 2.1.0-4ubuntu1
    • 2.1.0-4ubuntu1.1
    • 2.1.0-4ubuntu1.2
    • 2.1.0-4ubuntu1.3
    • 2.1.0-4ubuntu1.4
    • 2.1.0-4ubuntu1.4+esm1
    • 2.1.0-4ubuntu1.4+esm2
    • 2.1.0-4ubuntu1.4+esm4
    • 2.1.0-4ubuntu1.4+esm6
    • 2.1.0-4ubuntu1.4+esm7
    • 2.1.0-4ubuntu1.4+esm8
    • 2.1.0-4ubuntu1.4+esm9
    • 2.1.0-4ubuntu1.4+esm10
    Affected ranges
    • ECOSYSTEM: < 2.1.0-4ubuntu1.4+esm11

    Update to 2.1.0-4ubuntu1.4+esm11

  • vnc4 Ubuntu:Pro:14.04:LTS

    Versions
    • 4.1.1+xorg4.3.0-37ubuntu5
    • 4.1.1+xorg4.3.0-37ubuntu5.0.1
    • 4.1.1+xorg4.3.0-37ubuntu5.0.2
    • 4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vtk Ubuntu:Pro:14.04:LTS

    Versions
    • 5.8.0-14ubuntu1
    • 5.8.0-14ubuntu3
    • 5.8.0-14.1ubuntu2
    • 5.8.0-14.1ubuntu3
    • 5.8.0-14.1ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xmlrpc-c Ubuntu:Pro:14.04:LTS

    Versions
    • 1.16.33-3.2ubuntu3
    • 1.33.06-0ubuntu1
    • 1.33.06-0ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • expat Ubuntu:Pro:16.04:LTS

    Versions
    • 2.1.0-7
    • 2.1.0-7ubuntu0.16.04.1
    • 2.1.0-7ubuntu0.16.04.2
    • 2.1.0-7ubuntu0.16.04.3
    • 2.1.0-7ubuntu0.16.04.4
    • 2.1.0-7ubuntu0.16.04.5
    • 2.1.0-7ubuntu0.16.04.5+esm2
    • 2.1.0-7ubuntu0.16.04.5+esm5
    • 2.1.0-7ubuntu0.16.04.5+esm6
    • 2.1.0-7ubuntu0.16.04.5+esm7
    • 2.1.0-7ubuntu0.16.04.5+esm8
    • 2.1.0-7ubuntu0.16.04.5+esm9
    • 2.1.0-7ubuntu0.16.04.5+esm10
    Affected ranges
    • ECOSYSTEM: < 2.1.0-7ubuntu0.16.04.5+esm11

    Update to 2.1.0-7ubuntu0.16.04.5+esm11

  • libxmltok Ubuntu:Pro:16.04:LTS

    Versions
    • 1.2-3build3
    • 1.2-3ubuntu0.16.04.1~esm1
    • 1.2-3ubuntu0.16.04.1~esm2
    • 1.2-3ubuntu0.16.04.1~esm3
    • 1.2-3ubuntu0.16.04.1~esm4
    Affected ranges
    • ECOSYSTEM: < 1.2-3ubuntu0.16.04.1~esm5

    Update to 1.2-3ubuntu0.16.04.1~esm5

  • ayttm Ubuntu:Pro:16.04:LTS

    Versions
    • 0.6.3-3build1
    • 0.6.3-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cableswig Ubuntu:Pro:16.04:LTS

    Versions
    • 0.1.0+git20150808-1
    • 0.1.0+git20150808-2
    • 0.1.0+git20150808-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cadaver Ubuntu:16.04:LTS

    Versions
    • 0.23.3-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • coin3 Ubuntu:Pro:16.04:LTS

    Versions
    • 3.1.4~abc9f50+dfsg1-1
    • 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1
    • 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • gdcm Ubuntu:16.04:LTS

    Versions
    • 2.4.4-4
    • 2.4.4-4build1
    • 2.4.4-4ubuntu1
    • 2.6.1-3
    • 2.6.2-1
    • 2.6.2-2
    • 2.6.2-3
    • 2.6.3-1
    • 2.6.3-1ubuntu1
    • 2.6.3-2ubuntu1
    • 2.6.3-3ubuntu1
    • 2.6.3-3ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • insighttoolkit4 Ubuntu:16.04:LTS

    Versions
    • 4.8.1-1ubuntu3
    • 4.8.1-1ubuntu4
    • 4.8.2-3.1ubuntu1
    • 4.9.0-3ubuntu2
    • 4.9.0-4ubuntu1
    • 4.9.0-4ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • matanza Ubuntu:16.04:LTS

    Versions
    • 0.13+ds1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • smart Ubuntu:16.04:LTS

    Versions
    • 1.4-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • swish-e Ubuntu:Pro:16.04:LTS

    Versions
    • 2.4.7-4
    • 2.4.7-4build1
    • 2.4.7-4ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tdom Ubuntu:16.04:LTS

    Versions
    • 0.8.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vnc4 Ubuntu:Pro:16.04:LTS

    Versions
    • 4.1.1+xorg4.3.0-37.3ubuntu2
    • 4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vtk Ubuntu:Pro:16.04:LTS

    Versions
    • 5.10.1+dfsg-2
    • 5.10.1+dfsg-2build3
    • 5.10.1+dfsg-2.1build1
    • 5.10.1+dfsg-2.1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • wbxml2 Ubuntu:16.04:LTS

    Versions
    • 0.10.7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →