PT-2026-107540

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.9.0 Description A heap buffer over-read exists in the xmlparse.c file. The XML ParseBuffer function advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer...

JLSEC-2026-1230

libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse...

PT-2026-80468

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML GetBuffer, XML Parse, XML ParseBuffer, XML ParserFree, or XML ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,...

PT-2026-80473

libexpat before 2.8.2 has an integer overflow in XML ParseBuffer because it lacked a check that was present in XML Parse...

SUSE CVE-2026-56406

libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper validation in the XMLParseBuffer function. An attacker can cause unexpected behavior, including potential data corruption or application crashes, by providing specially crafted input that...

UBUNTU-CVE-2026-56406

libexpat before 2.8.2 has an integer overflow in XMLParseBuffer because it lacked a check that was present in XMLParse...

PT-2026-51242

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.2 Description An integer overflow occurs in the XML ParseBuffer function because it lacks a specific check that is implemented in the XML Parse function. Recommendations Update to version 2.8.2 or later...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: mingw-expat (UTSA-2026-004806)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004806 advisory. An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer. Tenable has extracted the preceding description...

SUSE-SU-2025:4512-1 Security update for mozjs52

This update for mozjs52 fixes the following issues: - CVE-2024-45491: Fixed integer overflow in dtdCopy bsc1230037 - CVE-2024-50602: Fixed DoS via XMLResumeParser bsc1232599 - CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart bsc1230038 - CVE-2024-45490: Fixed negative len for...

PT-2025-46035

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML ParseBuffer...

libexpat: Negative Length Parsing Vulnerability in libexpat

A flaw was found in libexpat's xmlparse.c component. This vulnerability allows an attacker to cause improper handling of XML data by providing a negative length value to the XMLParseBuffer function...

Astra Linux – Vulnerability in expat

A issue was discovered in libexpat before version 2.6.3. In xmlparse.c, a negative length value for XMLParseBuffer is allowed without being rejected...

Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to OpenSSL and libexpat

Summary OpenSSL and Libexpat used by IBM MQ Operator and Queue Manager container images are vulnerable to denial of service due to improper memory allocation, and providing weaker than expected security which might allow an attacker to execute arbitrary code on the system. This bulletin identifie...

SUSE CVE-2024-45490

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer...

ALPINE-CVE-2024-45490

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer...

AZL-48369 CVE-2024-45490 affecting package expat for versions less than 2.6.3-1

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer...

AZL-48372 CVE-2024-45490 affecting package expat for versions less than 2.6.3-1

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer...

OSV-2018-222 Heap-buffer-overflow in resip::ParseBuffer::qVal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6713 Crash type: Heap-buffer-overflow READ 1 Crash state: resip::ParseBuffer::qVal resip::QValueParameter::QValueParameter resip::QValueParameter::decode...

PT-2021-27551

Name of the Vulnerable Software and Affected Versions: resip affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash occurs in the resip::ParseBuffer::qVal function, which is called by resip::QValueParameter::QValueParameter and...