CVE-2025-66382: Libexpat Project Libexpat DOS Vulnerability

CVE-2025-66382 Overview

CVE-2025-66382 affects libexpat through version 2.7.3, a widely deployed XML parsing library. A crafted XML file of approximately 2 MiB can cause the parser to consume dozens of seconds of CPU time. The issue is classified as [CWE-407: Inefficient Algorithmic Complexity] and results in a local denial of service condition.

The flaw requires user interaction to open or process the malicious file. Exploitation does not disclose data or allow code execution, but it degrades availability of applications that embed libexpat for XML processing.

Critical Impact
A 2 MiB crafted XML file forces libexpat into prolonged parsing, exhausting CPU and stalling any application that consumes the file.

Affected Products

libexpat versions through 2.7.3
Siemens products bundling libexpat (see advisories SSA-082556 and SSA-253495)
Downstream software and Linux distributions embedding vulnerable libexpat builds

Discovery Timeline

2025-11-28 - CVE-2025-66382 published to the National Vulnerability Database
2025-12-02 - Details posted to the OpenWall oss-security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-66382

Vulnerability Analysis

libexpat is a stream-oriented XML parser used across programming languages, browsers, package managers, and embedded systems. CVE-2025-66382 is an algorithmic complexity issue in the parser's handling of specific XML structures. When libexpat processes a crafted file near 2 MiB in size, internal processing scales non-linearly, resulting in prolonged CPU utilization.

The attacker does not need network access or elevated privileges. A user must open or otherwise submit the file to a program that calls libexpat. Because libexpat is embedded in many command-line tools, document processors, and services, a single malicious input can stall pipelines and batch jobs.

The impact is limited to availability. Confidentiality and integrity are not affected. However, applications that rely on synchronous XML parsing can become unresponsive, and multi-tenant services can experience throughput degradation.

Root Cause

The root cause is inefficient algorithmic complexity in libexpat's parsing routines when handling specific input patterns in a crafted XML document. Rather than parsing in near-linear time, the affected code paths scale poorly with input size. Refer to GitHub Issue #1076 for the upstream discussion and reproducer references.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted XML file through email attachments, downloads, shared storage, or software supply chain artifacts. When a victim opens the file with an application that embeds libexpat, the parser enters a prolonged processing state and consumes CPU resources for dozens of seconds per file.

No authentication is required to craft or deliver the payload. Repeated submission of crafted files to a service that parses uploads can produce sustained resource exhaustion.

No verified public proof-of-concept code is referenced in the advisory. See the OpenWall oss-security post for disclosure details.

Detection Methods for CVE-2025-66382

Indicators of Compromise

XML files near 2 MiB that trigger multi-second CPU spikes in processes linking libexpat
Repeated submission of similar XML payloads to services that accept XML uploads
Application logs showing XML parse operations that exceed normal duration thresholds

Detection Strategies

Monitor CPU utilization of processes that call XML_Parse and correlate spikes with file ingestion events
Track parse durations in applications that expose XML processing metrics, and alert on outliers
Inspect ingress paths that accept XML for oversized or structurally anomalous documents

Monitoring Recommendations

Enable process-level telemetry on servers that parse untrusted XML, including runtime and memory counters
Alert on sustained high CPU on single threads within XML-consuming services
Log the size, source, and duration of every XML parse in customer-facing ingestion endpoints

How to Mitigate CVE-2025-66382

Immediate Actions Required

Inventory all software that links against libexpat through version 2.7.3, including bundled copies inside applications and containers
Apply operating system and vendor updates as soon as fixed libexpat packages are published
Restrict acceptance of untrusted XML input on internet-facing services until patched

Patch Information

At the time of publication, the upstream tracking issue is libexpat GitHub Issue #1076. Siemens has published product-specific guidance in SSA-082556 and SSA-253495. Consult Linux distribution advisories for the fixed package versions once released.

Workarounds

Enforce size limits on XML inputs at the application or proxy layer to reject files near or above 2 MiB
Run XML parsing in sandboxed worker processes with CPU time limits using ulimit or cgroups
Queue XML processing asynchronously so that a slow parse does not block user-facing requests

bash

# Configuration example: constrain XML parser CPU time with a cgroup (Linux)
sudo cgcreate -g cpu:/xmlparser
echo 20000 | sudo tee /sys/fs/cgroup/xmlparser/cpu.max   # 20ms per 100ms period
cgexec -g cpu:xmlparser /usr/bin/your-xml-consumer input.xml

# Or set a hard CPU-time limit per invocation
ulimit -t 5   # 5 seconds of CPU time
/usr/bin/your-xml-consumer input.xml