CVE-2026-76957

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary...

CVE-2026-76956

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness entropy for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result ...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

A issue was discovered in libexpat before version 2.6.4. There is a crash within the XMLResumeParser function, as XMLStopParser can stop/suspend a parser that has not been started...

UBUNTU-CVE-2026-76956

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content...

CVE-2026-76956

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content...

CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

CVE-2026-76957

CVE-2026-76957 affects libexpat before 2.8.4 . The root cause is the absence of handler call depth tracking when custom encoding callbacks are in use, which can lead to a use-after-free condition. The CVSS 3.1 score is 4.9 (Medium) with a local attack vector, high complexity, and low impact on co...

EUVD-2026-63196

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

CVE-2026-76956

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content...

CVE-2026-76956

In libexpat versions 2.8.2 and 2.8.3 (fixed in 2.8.4), misinterpretation of the getentropy() return code results in insufficient entropy, weakening the hash randomization that protects against hash-flooding. An attacker can send crafted XML content to force excessive hash collisions, causing CPU ...

EUVD-2026-63195

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content...

CVE-2026-76956

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content...

Linux Distros Unpatched Vulnerability : CVE-2026-76956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash...

Linux Distros Unpatched Vulnerability : CVE-2026-76957

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is similar to...

PT-2026-78884

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

PT-2026-78883

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: mozjs78 (UTSA-2024-003380)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-003380 advisory. xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context...

expat: libexpat: Denial of Service due to incorrect Unicode surrogate handling

A flaw in libexpat's toUtf16 functions mishandles Unicode low surrogates by treating them as high surrogates. An attacker can exploit the resulting out-of-bounds read to trigger an infinite loop, causing a denial of service DoS...