Introduction
Applications and services that parse XML can suffer severe resource exhaustion from one small input, which leads to denial of service or degraded performance. CVE-2025-59375 is a memory allocation flaw in libexpat, a core XML library used in a great many open source and commercial products. It matters because libexpat sits in so many software stacks, and because attackers can exploit the issue easily with crafted XML documents.
libexpat is a widely adopted C library for stream-oriented XML parsing. Operating systems, web servers, programming language runtimes, and application frameworks all embed it. Its reliability and permissive licensing have made it a foundational component of the software industry, with millions of deployments worldwide. A vulnerability in libexpat can therefore reach a wide range of downstream products and services.
Technical Information
CVE-2025-59375 comes from insufficient controls on dynamic memory allocation when libexpat parses XML documents. In affected versions (prior to 2.7.2), an attacker can submit a small, specially crafted XML document that makes the parser allocate far more memory than expected. This happens because certain code paths do not properly check or throttle allocation requests. The vulnerability is classified as CWE-770: Allocation of Resources Without Limits or Throttling.
The libexpat GitHub repository and its associated issues document the root cause:
By manipulating XML structures that the parser does not adequately constrain, an attacker can trigger large heap allocations. The process or the system can then run out of memory, which results in denial of service. libexpat version 2.7.2 fixes the issue with stricter allocation checks and improved resource management.
Affected Systems and Versions
- libexpat versions prior to 2.7.2 are affected
- All configurations that use a vulnerable version are at risk, especially those that parse untrusted XML input
- Both direct and indirect consumers of libexpat are affected, including applications and frameworks that bundle or link against the library
Vendor Security History
libexpat has had several resource management vulnerabilities in recent years:
- CVE-2024-8176: Stack overflow via recursive entity expansion (fixed in 2.7.0)
- CVE-2012-1148: Memory leak in poolGrow function
The maintainers have responded with targeted patches, and recent releases improve fuzzing coverage and resource checks. Resource exhaustion vulnerabilities keep recurring, though, which indicates ongoing architectural challenges.
