The vulnerability CVE-2026-25210 affects libexpat versions prior to 2.7.4. It arises from the doContent function's failure to properly check for integer overflow when determining the buffer size for tag buffer reallocation. This can cause an integer overflow or wraparound, potentially leading to buffer overflow and memory corruption. The CVSS 3.1 base score is 6.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating that exploitation requires local access with high attack complexity and no privileges or user interaction, and can result in high confidentiality and integrity impact with low availability impact. There is no vendor advisory or patch link currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an attacker with local access to cause memory corruption, potentially leading to unauthorized disclosure or modification of data. The impact on confidentiality and integrity is high, while availability impact is low. However, the attack complexity is high and no privileges or user interaction are required. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should limit local access to systems using vulnerable versions of libexpat and monitor for updates from the libexpat project. No specific vendor-provided mitigation or workaround information is currently available.