CVE-2026-25210: libexpat 2.7.4 fixes CVE-2026-24515 and CVE-2026-25210
Published Jan 30, 2026
·Updated
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
Affected Software
4 affected components
libexpat<2.7.4
Libexpat Project Libexpat<2.7.4
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.7.2.1 - 9.7.2.11
IBM Engineering Requirements Management DOORS and DOORS Web Access<=9.6.1.1 - 9.6.1.13
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libexpatto a version that resolves this vulnerability.Fixed in 2.7.4Patch CVE-2026-24515 - Upgrade
Upgrade
libexpatto a version that resolves this vulnerability.Fixed in 2.7.4Patch CVE-2026-25210
Event History
Jan 30, 2026
CVE Published
via MITRE·06:40 AM
Data Sourced
via MITRE·06:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
RemedyAffected Software
Jul 6, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-25210?
CVE-2026-25210 is classified as a medium severity vulnerability.
2
How do I fix CVE-2026-25210?
To mitigate CVE-2026-25210, upgrade libexpat to version 2.7.4 or later.
3
What versions of libexpat are affected by CVE-2026-25210?
CVE-2026-25210 affects all versions of libexpat prior to 2.7.4.
4
What component of libexpat is impacted by CVE-2026-25210?
CVE-2026-25210 impacts the doContent function within libexpat due to improper buffer size checks.
5
Is CVE-2026-25210 an integer overflow vulnerability?
Yes, CVE-2026-25210 is due to an integer overflow issue in buffer reallocation.