Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-59375

29
FAUCET Score

CVE-2025-59375 is a high-severity vulnerability affecting libexpat in Expat versions prior to 2.7.2, allowing attackers to trigger large dynamic memory allocations via small, specially crafted XML documents. This unauthenticated denial-of-service vulnerability (CVSS 7.5) can be exploited remotely with low complexity, potentially leading to system instability or crashes. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, including CISA alerts for Hitachi Energy RTU500 and Siemens SINEC OS products.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.7.2CPE matchmatch criteria
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
>= 0, < 2.7.2CPE match
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.28%
Probability of exploitation in next 30 days
EPSS Percentile
67.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0128 is in the 46th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (88)

microsoftpatch availablevia msrc
Product: cbl2 expat 2.6.4-1 on CBL Mariner 2.0Fixed in: 2.6.4-2
microsoftpatch availablevia msrc
Product: azl3 expat 2.6.4-1 on Azure Linux 3.0Fixed in: 2.6.4-2
microsoftpatch availablevia msrc
Product: azl3 expat 2.6.4-2 on Azure Linux 3.0Fixed in: 2.6.4-2
microsoftpatch availablevia msrc
Product: cbl2 expat 2.6.4-2 on CBL Mariner 2.0Fixed in: 2.6.4-2
microsoftpatch availablevia msrc
Product: 20210-17086Fixed in: 2.6.4-2
microsoftpatch availablevia msrc
Product: 17470-17084Fixed in: 2.6.4-2
microsoftpatch availablevia msrc
Product: 20572-17084Fixed in: 2.6.4-2
microsoftpatch availablevia msrc
Product: 20543-17086Fixed in: 2.6.4-2
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: spice-client-win-0:8.10-3.el8_4.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnFixed in: expat-0:2.2.10-1.el8_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: spice-client-win-0:8.10-3.el8_6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: expat-0:2.2.10-1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: spice-client-win-0:8.10-3.el8_6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: expat-0:2.2.10-1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: spice-client-win-0:8.10-3.el8_6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: expat-0:2.2.10-1.el8_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: spice-client-win-0:8.10-3.el8_8.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceFixed in: expat-0:2.2.10-1.el8_8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: spice-client-win-0:8.10-3.el8_8.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsFixed in: expat-0:2.2.10-1.el8_8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: expat-0:2.5.0-5.el9_7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: expat-0:2.2.10-12.el9_0.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsFixed in: expat-0:2.5.0-1.el9_2.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.4 Extended Update SupportFixed in: expat-0:2.5.0-2.el9_4.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.6 Extended Update SupportFixed in: expat-0:2.5.0-5.el9_6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Core Services 2.4.62.SP2Fixed in: expat
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.12Fixed in: rhcos-412.86.202601061735-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.13Fixed in: rhcos-413.92.202601130113-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.14Fixed in: rhcos-414.92.202601191325-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.15Fixed in: rhcos-415.92.202601271320-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.16Fixed in: rhcos-416.94.202601071926-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.17Fixed in: rhcos-417.94.202601120213-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.18Fixed in: rhcos-418.94.202601071817-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.19Fixed in: rhcos-4.19.9.6.202601130152-0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift Container Platform 4.20Fixed in: rhcos-4.20.9.6.202601052146-0
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-data-index-ephemeral-rhel8:1.36.0-11
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-data-index-postgresql-rhel8:1.36.0-11
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-db-migrator-tool-rhel8:1.36.0-11
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-jobs-service-ephemeral-rhel8:1.36.0-10
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-jobs-service-postgresql-rhel8:1.36.0-10
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8:1.36.0-4
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-management-console-rhel8:1.36.0-9
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-operator-bundle:1.36.0-12
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-rhel8-operator:1.36.0-18
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-swf-builder-rhel8:1.36.0-11
View patch
redhatpatch availablevia redhat_api
Product: RHOSS-1.36-RHEL-8Fixed in: openshift-serverless-1/logic-swf-devmode-rhel8:1.36.0-7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Advanced Cluster Security 4.7Fixed in: advanced-cluster-security/rhacs-scanner-db-rhel8:sha256:02a33bc81310601ebbe26391b472da8f558cbbd0c7ea1400f9cd7c3f44abb0ac
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Advanced Cluster Security 4.7Fixed in: advanced-cluster-security/rhacs-scanner-db-slim-rhel8:sha256:16f3506332224b30b82a3112e1dd9972cd15f1e6431c22ab3f584424aede986f
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Advanced Cluster Security 4.8Fixed in: advanced-cluster-security/rhacs-scanner-db-slim-rhel8:sha256:418a951de9a504a26ff31ef7f267cc6af7574a75de21d704cf1693d15c307e58
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/vllm-cuda-rhel9:sha256:bddcf7ab6d576572b6d60822c313ffebcd9869e4fde93e32ac327821f93cf32b
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/vllm-rocm-rhel9:sha256:7856bdb7ae0d643a7b9362c164d4d4fe3c0c7186f5fff73a7ae9835b3df52e57
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/model-opt-cuda-rhel9:sha256:14e32e88f1b89f59ed34a6d712746b82a6a54c6ed4727784f18aeff853abbdc7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/model-opt-cuda-rhel9:sha256:fca12d55fef49b9a67c8aa7c2c004adb8916b9784134b4e571067a615a7a4a2e
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/vllm-cuda-rhel9:sha256:f0ab1b678e9447eae4b6b2fe5c58531aa8524133db157f196726164e4dc20492
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/vllm-rocm-rhel9:sha256:e3b3efcdd86f60b90664a249d45918b2ac5f45bae5eed5399e310d63e878b287
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/vllm-tpu-rhel9:sha256:64796b48c68d31973a08e22c9530c39b1bc3ba9f376bbefa57643ef0fc857534
View patch
redhatpatch availablevia redhat_api
Product: Red Hat AI Inference Server 3.2Fixed in: rhaiis/vllm-rocm-rhel9:sha256:c5efe40fa2a6e98d7d3d6676befff0dbbd87b2887769bb7e5856c5b0b0ada125
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ceph Storage 8Fixed in: rhceph/rhceph-8-rhel9:sha256:a05f9ecd070a8a1ac7c8ba56d5551642f81d275f54f0af45e0ecb6e46103d4f8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ceph Storage 8Fixed in: rhceph/rhceph-8-rhel9:sha256:9e4f3ffb68eae556a6d34426903430173e4563eea3ea5d6720ce9b5b43c2dbda
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Discovery 2Fixed in: discovery/discovery-server-rhel9:sha256:75723049a444b5136e2d40920e2852f0840fecf60832a8bbb06e488fc9bba543
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Discovery 2Fixed in: discovery/discovery-ui-rhel9:sha256:899bd7f941512d54af8ab369ca03028a7d27d05887ccce24bc12c7ccd3e4dbee
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.8.1Fixed in: rhosdt/tempo-gateway-opa-rhel8:sha256:1a5d2d0363f67da79ed163a0334990ed47100fa9b27d0f5d6de175fd6eb262be
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.8.1Fixed in: rhosdt/tempo-gateway-rhel8:sha256:37e1131356229c7504b0eae1a3437e62473ad55b88b6431d874cc8ddf51cc560
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.8.1Fixed in: rhosdt/tempo-jaeger-query-rhel8:sha256:444e9e52db4c660e9c5bced414f5d1816ad205fe5a4938e06cd23860b0884b5e
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.8.1Fixed in: rhosdt/tempo-operator-bundle:sha256:f25a68576e0f207084864219afd15e6545e4942671cf52703cb97d1c37cc29da
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: expat-0:2.7.1-1.el10_0.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.8.1Fixed in: rhosdt/tempo-rhel8:sha256:f85e8bfdd18332d244fba78e3a848df5beae3695b88c866555f8dbfdfad8c337
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.8.1Fixed in: rhosdt/tempo-rhel8-operator:sha256:fe2a78e4f8e0430fff5e2a53be8c16b13a54441ed562c8549d8e1c6d0f8865ab
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Quay 3.16Fixed in: quay/quay-builder-rhel9:sha256:bf793a2407f484febf3185542e8db736766da04297104fe8ceac0071d6773206
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Update Infrastructure 5Fixed in: rhui5/cds-rhel9:sha256:a71cf22ac5a6c6488f6fd261b37ed423fb7f8ae21716d57542cb964908e5dff6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Update Infrastructure 5Fixed in: rhui5/haproxy-rhel9:sha256:67ea913cd9963ae2863633501da0fe05ddbdb6064d1f6ca9597649e44665f0ed
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Update Infrastructure 5Fixed in: rhui5/installer-rhel9:sha256:8641fa15608fbbb0d27c4b958cfaf52ca32f39f2b06b0b3e6d41c33ae902edbd
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Update Infrastructure 5Fixed in: rhui5/rhua-rhel9:sha256:72ac7afb81d57da7ee569790df6697785afe8f5b1379f3f6d3df5fc1ad741824
View patch
redhatpatch availablevia redhat_api
Product: Red Hat OpenShift distributed tracing 3.8.1Fixed in: rhosdt/tempo-query-rhel8:sha256:552768ac844b3316e67d7381660d22732e769e0eb22ad6efe314cebabe81d918
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: expat-0:2.7.1-1.el10_1.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: mingw-expat-0:2.5.0-1.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: expat-0:2.5.0-1.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: spice-client-win-0:8.10-3.el8_2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: expat-0:2.2.10-1.el8_2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: spice-client-win-0:8.10-3.el8_4.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: expat-0:2.2.10-1.el8_4
View patch
applevendor investigatingvia apple_support
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: thunderbird
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: firefox
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: thunderbird
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: firefox
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: thunderbird
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: firefox

Vendor Advisories (10)

redhatCVE-2025-59375Important

expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

Sep 15, 2025
microsoft2025-Sep/CVE-2025-59375Moderate

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Sep 9, 2025
appleapple:126348LOW

About the security content of macOS Tahoe 26.3 - Apple Support

appleapple:126349

About the security content of macOS Sequoia 15.7.4 - Apple Support

appleapple:126350

About the security content of macOS Sonoma 14.8.4 - Apple Support

appleapple:126346

About the security content of iOS 26.3 and iPadOS 26.3 - Apple Support

appleapple:126352

About the security content of watchOS 26.3 - Apple Support

appleapple:126353

About the security content of visionOS 26.3 - Apple Support

appleapple:126351

About the security content of tvOS 26.3 - Apple Support

appleapple:126347

About the security content of iOS 18.7.5 and iPadOS 18.7.5 - Apple Support

References

cert-portal.siemens.com / productcert/html/ssa-082556.html
cert-portal.siemens.com / productcert/html/ssa-089022.html
openwall.com / lists/oss-security/2025/09/16/2
openwall.com / lists/oss-security/2026/05/01/5
github.com / libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes
Product
github.com / libexpat/libexpat/blob/R_2_7_2/expat/Changes
Product
github.com / libexpat/libexpat/issues/1018
ExploitIssue Tracking
github.com / libexpat/libexpat/pull/1034
Issue Tracking
issues.oss-fuzz.com / issues/439133977
ExploitIssue Tracking