CVE-2025-59375 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 19%

Affected Products (NVD)

Vendor	Product	Version
libexpat_project	libexpat	𝑥 < 2.7.2

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	RUGGEDCOM RST2428P	𝑥 < V3.3	ADP
Siemens	SCALANCE XC-300\/XR-300\/XC-400\/XR-500WG\/XR-500 family	𝑥 < V3.3	ADP
Siemens	SCALANCE XCH328	𝑥 < V3.3	ADP
Siemens	SCALANCE XCM324	𝑥 < V3.3	ADP
Siemens	SCALANCE XCM328	𝑥 < V3.3	ADP
Siemens	SCALANCE XCM332	𝑥 < V3.3	ADP
Siemens	SCALANCE XRH334 \(24 V DC\, 8xFO\, CC\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(230 V AC\, 12xFO\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(230 V AC\, 8xFO\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(230V AC\, 2x10G\, 24xSFP\, 8xSFP\+\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(24 V DC\, 12xFO\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(24 V DC\, 8xFO\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(24V DC\, 2x10G\, 24xSFP\, 8xSFP\+\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(2x230 V AC\, 12xFO\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(2x230 V AC\, 8xFO\)	𝑥 < V3.3	ADP
Siemens	SCALANCE XRM334 \(2x230V AC\, 2x10G\, 24xSFP\, 8xSFP\+\)	𝑥 < V3.3	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIPLUS S7-1500 CPU 1518-4 PN\/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

expat

bookworm	ignored
bookworm (security)	vulnerable
bullseye	ignored
bullseye (security)	vulnerable
forky	2.8.0-1 fixed
sid	2.8.0-2 fixed
trixie	no-dsa

firefox

sid	151.0-1 fixed

firefox-esr

bookworm	140.10.2esr-1~deb12u1 fixed
bookworm (security)	140.11.0esr-1~deb12u1 fixed
bullseye	vulnerable
bullseye (security)	140.11.0esr-1~deb11u1 fixed
forky	140.10.2esr-1 fixed
sid	140.11.0esr-1 fixed
trixie	140.10.2esr-1~deb13u1 fixed
trixie (security)	140.11.0esr-1~deb13u1 fixed

thunderbird

bookworm	1:140.10.1esr-1~deb12u1 fixed
bookworm (security)	1:140.11.0esr-1~deb12u1 fixed
bullseye	vulnerable
bullseye (security)	1:140.11.0esr-1~deb11u1 fixed
forky	1:140.10.2esr-1 fixed
sid	1:140.11.0esr-1 fixed
trixie	1:140.10.1esr-1~deb13u1 fixed
trixie (security)	1:140.11.0esr-1~deb13u1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

MozillaFirefox

suse enterprise desktop 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise server 12 SP3	140.9.0-112.304.2 fixed
suse enterprise server 12 SP5	140.9.0-112.304.2 fixed
suse enterprise server 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP6	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP7	140.9.0-150200.152.225.1 fixed

MozillaFirefox-devel

suse enterprise desktop 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise server 12 SP3	140.9.0-112.304.2 fixed
suse enterprise server 12 SP5	140.9.0-112.304.2 fixed
suse enterprise server 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP6	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP7	140.9.0-150200.152.225.1 fixed

MozillaFirefox-translations-common

suse enterprise desktop 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise server 12 SP3	140.9.0-112.304.2 fixed
suse enterprise server 12 SP5	140.9.0-112.304.2 fixed
suse enterprise server 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP6	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP7	140.9.0-150200.152.225.1 fixed

MozillaFirefox-translations-other

suse enterprise desktop 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise sap 15 SP7	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP4	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP5	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP6	140.9.0-150200.152.225.1 fixed
suse enterprise server 15 SP7	140.9.0-150200.152.225.1 fixed

MozillaThunderbird

suse enterprise desktop 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise sap 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise server 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise workstation 15 SP7	140.9.0-150200.8.263.1 fixed

MozillaThunderbird-translations-common

suse enterprise desktop 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise sap 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise server 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise workstation 15 SP7	140.9.0-150200.8.263.1 fixed

MozillaThunderbird-translations-other

suse enterprise desktop 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise sap 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise server 15 SP7	140.9.0-150200.8.263.1 fixed
suse enterprise workstation 15 SP7	140.9.0-150200.8.263.1 fixed

expat

suse enterprise desktop 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise desktop 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise sap 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise server 12 SP3	2.7.1-21.46.1 fixed
suse enterprise server 12 SP5	2.7.1-21.46.1 fixed
suse enterprise server 15 SP2	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP3	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.6.1 fixed

libexpat-devel

suse enterprise desktop 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise desktop 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise sap 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise server 12 SP5	2.7.1-21.46.1 fixed
suse enterprise server 15 SP2	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP3	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.6.1 fixed

libexpat1

suse enterprise desktop 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise desktop 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise sap 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise server 12 SP3	2.7.1-21.46.1 fixed
suse enterprise server 12 SP5	2.7.1-21.46.1 fixed
suse enterprise server 15 SP2	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP3	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.6.1 fixed

libexpat1-32bit

suse enterprise desktop 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise desktop 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise sap 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise sap 15 SP7	2.7.1-150700.3.6.1 fixed
suse enterprise server 12 SP3	2.7.1-21.46.1 fixed
suse enterprise server 12 SP5	2.7.1-21.46.1 fixed
suse enterprise server 15 SP2	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP3	2.7.1-150000.3.39.1 fixed
suse enterprise server 15 SP4	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP5	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP6	2.7.1-150400.3.31.1 fixed
suse enterprise server 15 SP7	2.7.1-150700.3.6.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

expat

RHEL 8	0:2.5.0-1.el8_10 fixed
RHEL 9	0:2.5.0-5.el9_7.1 fixed

expat-devel

RHEL 8	0:2.5.0-1.el8_10 fixed
RHEL 9	0:2.5.0-5.el9_7.1 fixed

mingw32-expat

RHEL 8

0:2.5.0-1.el8_10

fixed

mingw32-fontconfig

RHEL 8

0:2.12.6-4.el8_10

fixed

mingw64-expat

RHEL 8

0:2.5.0-1.el8_10

fixed

mingw64-fontconfig

RHEL 8

0:2.12.6-4.el8_10

fixed

python3.12

RHEL 8	0:3.12.13-2.el8_10 fixed
RHEL 9	0:3.12.13-2.el9_8 fixed

python3.12-debug

RHEL 8	0:3.12.13-2.el8_10 fixed
RHEL 9	0:3.12.13-2.el9_8 fixed

python3.12-devel

RHEL 8	0:3.12.13-2.el8_10 fixed
RHEL 9	0:3.12.13-2.el9_8 fixed

python3.12-idle

RHEL 8	0:3.12.13-2.el8_10 fixed
RHEL 9	0:3.12.13-2.el9_8 fixed

python3.12-libs

RHEL 8	0:3.12.13-2.el8_10 fixed
RHEL 9	0:3.12.13-2.el9_8 fixed

python3.12-rpm-macros

RHEL 8

0:3.12.13-2.el8_10

fixed

python3.12-test

RHEL 8	0:3.12.13-2.el8_10 fixed
RHEL 9	0:3.12.13-2.el9_8 fixed

python3.12-tkinter

RHEL 8	0:3.12.13-2.el8_10 fixed
RHEL 9	0:3.12.13-2.el9_8 fixed

spice-client-win-x64

RHEL 8.2 AUS	0:8.10-3.el8_2.1 fixed
RHEL 8.4 AUS	0:8.10-3.el8_4.1 fixed
RHEL 8.6 AUS	0:8.10-3.el8_6.1 fixed
RHEL 8.6 E4S	0:8.10-3.el8_6.1 fixed
RHEL 8.6 TUS	0:8.10-3.el8_6.1 fixed
RHEL 8.8 E4S	0:8.10-3.el8_8.1 fixed
RHEL 8.8 TUS	0:8.10-3.el8_8.1 fixed

spice-client-win-x86

RHEL 8.2 AUS	0:8.10-3.el8_2.1 fixed
RHEL 8.4 AUS	0:8.10-3.el8_4.1 fixed
RHEL 8.6 AUS	0:8.10-3.el8_6.1 fixed
RHEL 8.6 E4S	0:8.10-3.el8_6.1 fixed
RHEL 8.6 TUS	0:8.10-3.el8_6.1 fixed
RHEL 8.8 E4S	0:8.10-3.el8_8.1 fixed
RHEL 8.8 TUS	0:8.10-3.el8_8.1 fixed

Known Exploits!

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74

https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes

https://github.com/libexpat/libexpat/issues/1018

https://github.com/libexpat/libexpat/pull/1034

https://issues.oss-fuzz.com/issues/439133977

http://www.openwall.com/lists/oss-security/2025/09/16/2

http://www.openwall.com/lists/oss-security/2026/05/01/5

https://cert-portal.siemens.com/productcert/html/ssa-082556.html

https://cert-portal.siemens.com/productcert/html/ssa-089022.html