The vulnerability CVE-2026-25210 affects libexpat prior to version 2.7.4. It arises because the doContent function fails to perform an integer overflow check when determining the buffer size for tag buffer reallocation. This can result in an integer overflow or wraparound, leading to incorrect buffer size calculation. Such a flaw can cause memory corruption issues that impact confidentiality and integrity of the processed data. The CVSS 3.1 base score is 6.9 with vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating local attack vector with high complexity and no privileges or user interaction required.

The vulnerability allows an attacker with local access to trigger an integer overflow during buffer reallocation in libexpat, potentially leading to memory corruption. This can compromise confidentiality and integrity of data processed by the library, with a lesser impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor libexpat project communications for updates. Until a fix is available, avoid processing untrusted input with vulnerable versions of libexpat where possible.