USN-8790-1: Expat vulnerabilities
Ubuntu patched three Expat denial-of-service vulnerabilities, including excessive memory allocation on crafted documents and an infinite loop on DTD content.
Ubuntu security notice USN-8790-1 fixes multiple Expat vulnerabilities. CVE-2025-59375 allows large memory allocation when parsing a small crafted document, enabling denial of service, and was only addressed in Ubuntu 24.04 LTS. CVE-2026-32776 involves incorrect handling of empty external parameter entity content causing crashes, and a third issue causes an infinite loop when processing certain DTD content.
- Expat XML parser flaws allow denial of service via crafted documents
- CVE-2025-59375 only fixed in Ubuntu 24.04 LTS
- Issues include memory exhaustion, crash, and infinite loop conditions
- Organizations
- Ubuntu
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-59375 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing | 7.5 | 1% | PoC ×2 | |
| CVE-2026-32776 | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content | 5.5 | <1% |
From the original article
It was discovered that Expat could be made to allocate large amounts of memory when parsing a small crafted document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 24.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.