| Name | CVE-2025-59375 |
| Description | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1115298 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| expat (PTS) | bullseye | 2.2.10-2+deb11u5 | vulnerable |
| bullseye (security) | 2.2.10-2+deb11u7 | vulnerable | |
| bookworm | 2.5.0-1+deb12u2 | vulnerable | |
| bookworm (security) | 2.5.0-1+deb12u1 | vulnerable | |
| trixie | 2.7.1-2 | vulnerable | |
| forky, sid | 2.7.3-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| expat | source | (unstable) | 2.7.2-1 | 1115298 |
https://github.com/libexpat/libexpat/issues/1018
https://github.com/libexpat/libexpat/pull/1034
Fixed by: https://github.com/libexpat/libexpat/commit/0872c189db6e457084fca335662a9cb49e8ec4c7 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/8768dadae479d9f2e984b747fb2ba79bb78de94f (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/4fc6f1ee9f2b282cfe446bf645c992e37f8c3e15 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/51487ad9d760faa4809b0f8e189d2f666317e41a (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/4e7a5d03daf672f20c73d40dc8970385c18b30d3 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/53a3eda0ae2e0317afd071b72b41976053d82732 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/b3f0bda5f5e979781469532f7c304f7e223568d5 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/20b4c2ee4554e3f261c2fe93fe5759a7e66c17a4 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/1270e5bc0836d296ac4970fc9e1cf53d83972083 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/cfce28e171676fe6f70d17b97ed8a59eaeb83f15 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/7e35240dc97e9fd4f609e31f27c27b659535e436 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/ae4086198d710a62a0a1560007b81307dba72909 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/96c7467281c72028aada525c1d3822512758b266 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/78366891a586f293aeff60a14a55e4afe1169586 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/31f9053c3c46741f4daf2ea2bdea75f40f720d42 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/5ae51be57ed0ca1e87582881d07ea9c29c4f7c05 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/a6a2a49367f03f5d8a73c9027b45b59953ca27d8 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/d6246c31a1238d065b4d9690d3bac740326f6485 (R_2_7_2)
Fixed by: https://github.com/libexpat/libexpat/commit/a21a3a8299e1ee0b0ae5ae2886a0746d088cf135 (R_2_7_2)
https://www.openwall.com/lists/oss-security/2025/09/24/11
Follow-up: https://github.com/libexpat/libexpat/pull/1048 (R_2_7_3)