expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking

A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition,...

expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow

A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly...

expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking

A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition,...

expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow

A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly...

expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow

A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly...

expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking

A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition,...

RHEL 9 : expat (RHSA-2026:64812)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:64812 advisory. Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call...

Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

ALSA-2026:64812 Moderate: expat security update

Expat is a C library for parsing XML documents. Security Fixes: expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking CVE-2026-50219 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow CVE-2026-56132 For more details about the security...

EulerOS 2.0 SP12 : expat (EulerOS-SA-2026-3258)

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLResumeParser from within handlers in cases of a policy violation. Thus, a...

Updated mingw-expat & expat packages fix security vulnerabilities

Expat Denial of Service via storeAtts Quadratic Complexity. CVE-2026-66046 Expat Out-of-Bounds Read via dtdCopy. CVE-2026-76641 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding...

MGASA-2026-0378 Updated mingw-expat & expat packages fix security vulnerabilities

Expat Denial of Service via storeAtts Quadratic Complexity. CVE-2026-66046 Expat Out-of-Bounds Read via dtdCopy. CVE-2026-76641 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding...

FreeBSD : expat2 -- Out-of-bounds Read (11ab3b16-a65d-11f1-a49c-00a0980083d7)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 11ab3b16-a65d-11f1-a49c-00a0980083d7 advisory. https://github.com/libexpat/libexpat/pull/1331 reports: Expat through 2.8.3 contains an out-of-bounds...

Amazon Linux 2023 : firefox (ALAS2023-2026-2105)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2105 advisory. Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with...

libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness entropy for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result ...

libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary...

CVE-2026-76957

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary...

CVE-2026-76956

A flaw was found in libexpat. This vulnerability arises from the software misinterpreting a return code, leading to insufficient randomness entropy for hash functions. A remote attacker could exploit this by sending specially crafted XML content, triggering hash flooding attacks. This can result ...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, Expat, LibXMLTok

LibExpat through version 2.5.0 causes a denial of service resource consumption because multiple reparings are required when dealing with large tokens, resulting in multiple buffer fills...

Astra Linux – Vulnerabilities in expat, Firefox, Thunderbird

There is a stack overflow vulnerability in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat may be forced to recur indefinitely, exhausting the stack space and causing a crash...