CVE-2025-66382

MediumCVSS 5.5/10Last modified Oct 19, 2026

Description

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-407

Affected software

VendorProductVersions
libexpat projectlibexpat<= 2.7.5
SiemensRUGGEDCOM RST2428P< V4.0
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.5, < *
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.5, < *

References

Timeline

Published
Nov 28, 2025
Last modified
Oct 19, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-663848.2app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.CVE-2025-663859.4UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a highCVE-2025-663864.1app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.CVE-2025-663886.5A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properCVE-2025-663897.5GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to feCVE-2025-66395.4The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versiCVE-2025-663909.8In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in TenantCVE-2025-663918.8In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., theCVE-2025-663958.8ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/ListEvents.phCVE-2025-663967.2ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/UserEditor.phCVE-2025-663978.3ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKCVE-2025-663988.8Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollu
CVE-2025-66382: Medium severity, CVSS 5.5 | Vulnix