CVE-2026-25210

{"id": "CVE-2026-25210", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 1.4}]}, "published": "2026-01-30T07:16:15.570", "references": [{"url": "https://github.com/libexpat/libexpat/pull/1075", "source": "cve@mitre.org"}, {"url": "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7", "source": "cve@mitre.org"}], "vulnStatus": "Received", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation."}, {"lang": "es", "value": "En libexpat antes de 2.7.4, la funci\u00f3n doContent no determina correctamente el tama\u00f1o del b\u00fafer bufSize porque no hay una comprobaci\u00f3n de desbordamiento de entero para la reasignaci\u00f3n del b\u00fafer de etiquetas."}], "lastModified": "2026-01-30T07:16:15.570", "sourceIdentifier": "cve@mitre.org"}