Vulnpedia
← All CVEs

CVE-2025-59375

HIGH 7.5 ALL-YEARS

Published 2025-09-15 · Last modified 2026-10-15 · mitre · NVD: Modified

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

ELEVATED IMPACT

Severe if exploited (CVSS 7.5), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

1.4%chance of exploitation in 30 days · 72nd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

7.5CVSS 3.1 · HIGH · CNA

  • ConfidentialityNone
  • IntegrityNone
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Libexpat Project Siemens

Products Libexpat Ruggedcom Rst2428p Scalance Xc 300/Xr 300/Xc 400/Xr 500wg/Xr 500 Family Scalance Xch328 Scalance Xcm324 Scalance Xcm328 Scalance Xcm332 Scalance Xrh334 (24 V Dc, 8xfo, Cc) Scalance Xrm334 (230 V Ac, 12xfo) Scalance Xrm334 (230 V Ac, 8xfo) Scalance Xrm334 (230v Ac, 2x10g, 24xsfp, 8xsfp+) Scalance Xrm334 (24 V Dc, 12xfo) Scalance Xrm334 (24 V Dc, 8xfo) Scalance Xrm334 (24v Dc, 2x10g, 24xsfp, 8xsfp+) Scalance Xrm334 (2x230 V Ac, 12xfo) Scalance Xrm334 (2x230 V Ac, 8xfo) Scalance Xrm334 (2x230v Ac, 2x10g, 24xsfp, 8xsfp+) Simatic S7 1500 Cpu 1518 4 Pn/Dp Mfp Simatic S7 1500 Cpu 1518f 4 Pn/Dp Mfp Siplus S7 1500 Cpu 1518 4 Pn/Dp Mfp

Weakness (CWE)

  • CWE-770: Allocation of Resources Without Limits or Throttling

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:T/RC:C

References and research data (JSON)

Vendor product assessments

Showing 32 of 831 vendor product statements; 799 omitted. Read the full vendor advisory.

  • rhcos-x86_64-412.86.202601061735-0 as a component of Red Hat OpenShift Container Platform 4.12 · fixed

    Vendor assessment for this product only.

    pkg:generic/redhat/[email protected]?arch=x86_64

    • vendor fix: For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:9ea794d2dd24ff7377534edfb0447e5398a28919a84300cc79fe7bb8ae550d1b All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • rhcos-x86_64-418.94.202601071817-0 as a component of Red Hat OpenShift Container Platform 4.18 · fixed

    Vendor assessment for this product only.

    pkg:generic/redhat/[email protected]?arch=x86_64

    • vendor fix: For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:64e8c4cbd3199beb1ebb8d6a208cb81fdfe62f4e52d7586033f534d35f981244 (For s390x architecture) The image digest is sha256:5b964fa43873a20a66b95769bbcd6c31b028f505281fb045bb3c2ed6ca114e91 (For ppc64le architecture) The image digest is sha256:2108325c5ee08249e1b0c0ad6a3daab197f5e2a1a83c8600d27c49ad0ff94307 (For aarch64 architecture) The image digest is sha256:b465cef295a81eaf055c87a9af6d8ecdcc11cb1e898895d6df527eb155a7ff82 All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli. Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • python3.12-0:3.12.13-2.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • spice-client-win-x86-0:8.10-3.el8_8.1.noarch as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8.1?arch=noarch

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • python3.12-libs-0:3.12.13-2.el9_8.i686 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=i686

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • expat-0:2.5.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • expat-0:2.5.0-1.el9_2.3.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.3?arch=src

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • python3.12-debuginfo-0:3.12.13-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • python3.12-debuginfo-0:3.12.13-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:a05f9ecd070a8a1ac7c8ba56d5551642f81d275f54f0af45e0ecb6e46103d4f8_ppc64le as a component of Red Hat Ceph Storage 8 · fixed

    Vendor assessment for this product only.

    pkg:oci/rhceph-8-rhel9@sha256%3Aa05f9ecd070a8a1ac7c8ba56d5551642f81d275f54f0af45e0ecb6e46103d4f8?arch=ppc64le&repository_url=registry.redhat.io/rhceph

    • vendor fix: The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • registry.redhat.io/rhui5/rhua-tp-rhel9@sha256:2dc99bbbcad15bd50b1ad227f6d4557f5b17fed7388e3eb127c058e3f4636b15_amd64 as a component of Red Hat Update Infrastructure 5 · fixed

    Vendor assessment for this product only.

    pkg:oci/rhua-tp-rhel9@sha256%3A2dc99bbbcad15bd50b1ad227f6d4557f5b17fed7388e3eb127c058e3f4636b15?arch=amd64&repository_url=registry.redhat.io/rhui5/rhua-tp-rhel9&tag=1787241260

    • vendor fix: Please consult the RHUI Technology Preview Release Notes at https://access.redhat.com/articles/7141172 for instructions on how to use this image set. Vendor guidance
    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • firefox as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/firefox

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • firefox.src as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/firefox?arch=src

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • thunderbird as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • firefox as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/firefox

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • firefox.src as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/firefox?arch=src

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • thunderbird as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • thunderbird.src as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird?arch=src

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • firefox as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/firefox

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • firefox.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/firefox?arch=src

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • thunderbird as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • thunderbird.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/thunderbird?arch=src

    • workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption.
    • no fix planned: Will not fix
    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • expat-debuginfo-0:2.2.10-12.el9_0.4.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.0) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_0.4?arch=aarch64

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • expat-debuginfo-0:2.5.0-2.el9_4.3.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.4) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_4.3?arch=x86_64

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • expat-debuginfo-0:2.2.10-1.el8_6.x86_64 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.6) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_6?arch=x86_64

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • expat-debugsource-0:2.2.10-1.el8_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_8?arch=x86_64

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • expat-debuginfo-0:2.5.0-2.el9_4.3.i686 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/[email protected]_4.3?arch=i686

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel8@sha256:7c0a23278a9180c3f586004986fea37fdaa29905997368290ec5633fd14d6107_ppc64le as a component of Red Hat Advanced Cluster Security 4.7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhacs-scanner-slim-rhel8@sha256%3A7c0a23278a9180c3f586004986fea37fdaa29905997368290ec5633fd14d6107?arch=ppc64le&repository_url=registry.redhat.io/advanced-cluster-security

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:1b6d931578d1e5e82e305e62a8328278b8292d63ef70a88b436fae6c171905b5_s390x as a component of Red Hat Advanced Cluster Security 4.8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/rhacs-scanner-db-rhel8@sha256%3A1b6d931578d1e5e82e305e62a8328278b8292d63ef70a88b436fae6c171905b5?arch=s390x&repository_url=registry.redhat.io/advanced-cluster-security

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:cec72610bc57414cba82f7089059af4408d7c51022c15bd0214e03a1c313e950_arm64 as a component of Red Hat Ceph Storage 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/keepalived-rhel9@sha256%3Acec72610bc57414cba82f7089059af4408d7c51022c15bd0214e03a1c313e950?arch=arm64&repository_url=registry.redhat.io/rhceph

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:84021c67a5bd508aff6efc6e641f108175e617ef3eef2019f5cecd25dc9a0691_amd64 as a component of Red Hat Quay 3.16 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A84021c67a5bd508aff6efc6e641f108175e617ef3eef2019f5cecd25dc9a0691?arch=amd64&repository_url=registry.redhat.io/quay&tag=1767970158

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00
  • xmlrpc-c.src as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/xmlrpc-c?arch=src

    Red Hat · CVE-2025-59375 · Updated 2026-10-09T01:06:12+00:00

Known Affected Software Configurations

VendorProductVersion range
Libexpat ProjectLibexpat< 2.7.2

All CVSS metrics

  • HIGH 7.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:T/RC:C
  • HIGH 7.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Exploit-tagged references (not proof of a PoC)

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS