Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

In libexpat before version 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data...

Linux Distros Unpatched Vulnerability : CVE-2026-76875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attacke...

DEBIAN-CVE-2026-76875

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

CVE-2026-76875

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

UBUNTU-CVE-2026-76875

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

CVE-2026-76875

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

EUVD-2026-88811

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

CVE-2026-76875

PyPy versions before 3.11.16 and 3.12.14 are vulnerable to a use-after-free flaw in the pyexpat module's ExternalEntityParserCreate function. The issue occurs when an application creates external-entity sub-parsers without retaining a reference to the parent parser; the child parser keeps a raw C...

CVE-2026-76875 PyPy pyexpat ExternalEntityParserCreate Use-After-Free

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

CVE-2026-76875 PyPy pyexpat ExternalEntityParserCreate Use-After-Free

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

CVE-2026-76875 PyPy pyexpat ExternalEntityParserCreate Use-After-Free

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

CVE-2026-76875: Use After Free

PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a...

PT-2026-102606

Name of the Vulnerable Software and Affected Versions PyPy versions prior to 3.11.16 PyPy versions prior to 3.12.14 Description A use-after-free issue exists in the pyexpat module's ExternalEntityParserCreate function. This occurs when applications create external-entity sub-parsers without...

PT-2026-79084

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.4 Description An out-of-bounds read allows attackers to trigger memory corruption when processing XML using external entity parsers created via the XML ExternalEntityParserCreate function. A struct size mismatch...

CLSA-2026-1770741587 expat: Fix of CVE-2026-24515

CVE-2026-24515: fix NULL pointer dereference in XMLExternalEntityParserCreate...

CLSA-2026-1770732201 Fix CVE(s): CVE-2026-24515

SECURITY UPDATE: XMLExternalEntityParserCreate failure to copy the encoding handler data can cause a NULL dereference. - debian/patches/CVE-2026-24515.patch: Make XMLExternalEntityParserCreate copy unknown encoding handler user data - CVE-2026-24515...

CLSA-2026-1770394049 expat: Fix of CVE-2026-24515

CVE-2026-24515: fix NULL pointer dereference in XMLExternalEntityParserCreate...

expat -- multiple vulnerabilities

expat team reports: Update contains 2 security fixes: CVE-2026-24515: NULL dereference in function XMLExternalEntityParserCreate CVE-2026-25210: missing check for integer overflow in function doContent...

ALPINE-CVE-2026-24515

In libexpat before 2.7.4, XMLExternalEntityParserCreate does not copy unknown encoding handler user data...

PT-2025-46030

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML ExternalEntityParserCreate in out-of-memory situations...