CVE-2026-25210
Published: 30 January 2026
Summary
CVE-2026-25210 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Libexpat Project Libexpat. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25210 is an integer overflow vulnerability (CWE-190) in the doContent function of libexpat versions prior to 2.7.4. The issue arises because there is no integer overflow check during tag buffer reallocation, leading to an improper determination of the buffer size bufSize. This flaw was published on 2026-01-30 and carries a CVSS v3.1 base score of 6.9 (Medium), with vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.
A local attacker with no privileges required can exploit this vulnerability, though it demands high attack complexity and no user interaction. Successful exploitation allows high-impact confidentiality and integrity violations, such as unauthorized data disclosure or modification, alongside low availability disruption within the unchanged scope.
Mitigation is addressed in libexpat via the patch merged in pull request #1075, including the specific commit 9c2d990389e6abe2e44527eeaa8b39f16fe859c7. Security practitioners should upgrade affected libexpat instances to version 2.7.4 or later to resolve the integer overflow.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5042
Vulnerability details
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local memory corruption (integer overflow in XML buffer handling) with PR:N and high C/I impact enables code execution or data tampering within a target process, directly facilitating T1068 Exploitation for Privilege Escalation when the vulnerable library runs in a higher-privileged context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor patch (libexpat 2.7.4+) that adds the missing integer-overflow check in doContent buffer reallocation.
Mandates validation of numeric inputs and size calculations, exactly the integer-overflow check absent from tag-buffer reallocation in doContent.
Requires integrity verification of software components, enabling detection of an unpatched or tampered libexpat binary that still contains the flawed doContent logic.