CVE-2026-25210: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-25210 is an integer overflow vulnerability in libexpat (the Expat XML parsing library) affecting all versions before 2.7.4. The flaw exists in the doContent function, which does not properly determine the buffer size bufSize due to a missing integer overflow check during tag buffer reallocation. It was disclosed on January 30, 2026, with the underlying fix merged into the libexpat repository on October 3, 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, GitHub PR).

The root cause is an integer overflow or wraparound (CWE-190) in the doContent function within expat/lib/xmlparse.c. When reallocating the tag buffer, the code doubles the current buffer size without first checking whether that doubling would overflow a size_t value, allowing the computed bufSize to wrap around to a small value. The fix, introduced in commit 9c2d990, adds a guard check (if (SIZE_MAX / 2 < (size_t)(tag->bufEnd - tag->buf)) return XML_ERROR_NO_MEMORY;) before the doubling operation. Exploitation requires a local attacker with low privileges to supply a crafted XML document that triggers the vulnerable reallocation path; no network access is required (GitHub PR, GitHub Commit).

Successful exploitation allows a local low-privileged user to execute arbitrary code with the privileges of the process using libexpat, as well as read or modify sensitive data on the affected system. Because libexpat is a widely embedded XML parsing library used by Python, Firefox, OpenBSD, Splunk, Oracle products, and many Linux distributions, the blast radius extends across a broad ecosystem of dependent software. Confidentiality, integrity, and availability are all rated High, though the scope is limited to the affected process and does not inherently enable cross-privilege-boundary escalation (Red Hat Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.005% (0.000050), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Oracle's April 2026 Critical Patch Update noted that CVE-2026-25210 is present in Oracle RDBMS (libexpat) but assessed the vulnerable code as not controllable by an adversary in that context (Oracle CPU April 2026).

The primary remediation is to upgrade libexpat to version 2.7.4 or later, which includes the integer overflow check in the doContent function (GitHub PR). Downstream distributions including Ubuntu (USN-8022-1, USN-8022-2), SUSE, Mageia, OpenBSD, Amazon Linux 2, FreeBSD, and Slackware have all released updated packages. Python releases 3.10.20, 3.11.15, and 3.12.13 also bundle the patched libexpat. Organizations should audit all software that statically or dynamically links libexpat and prioritize patching, particularly for applications that parse untrusted XML from local users (Red Hat Advisory, Oracle CPU April 2026).

The libexpat maintainer Sebastian Pipping (hartwork) published a release announcement for expat 2.7.4 covering this and a companion CVE, and the fix was discussed on the oss-security mailing list (oss-sec). The vulnerability received broad coverage across Linux distribution security channels (SUSE, Ubuntu, Mageia, FreeBSD, OpenBSD, Amazon Linux), reflecting the library's ubiquity. Community reaction on social platforms was measured, with no significant alarm given the local-only attack vector and absence of a public PoC.