CVE-2026-124317

libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknowntoUtf8 and unknowntoUtf16 in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer...

EUVD-2026-119271

libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknowntoUtf8 and unknowntoUtf16 in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer...

CVE-2026-124317

The libexpat library, version 2.10.0 and prior, contains an out-of-bounds read vulnerability within the unknown_toUtf8() and unknown_toUtf16() functions in xmltok.c. This issue occurs when the library processes application-registered unknown encodings, specifically when an attacker provides a doc...