Every CVE Search/ Get API key

CVE-2026-102633

libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc

8.2 HighFix available

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.37%Unchanged since Sep 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.2

libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
CVE-2026-102633
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-89028 8.2

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
EUVD-2026-89028
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-533f-rf84-jgcc 8.2

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc(...

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
GHSA-533f-rf84-jgcc
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
NVD 8.2

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
CVE-2026-102633
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2026-102633 5.9

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
ALPINE-CVE-2026-102633
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-102633 5.9
Record
BELL-CVE-2026-102633
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 21 moreShow less
OSV 8.2

libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
CVE-2026-102633
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190
Updated
2026-11-07
OSVDEBIAN-CVE-2026-102633 5.9

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
DEBIAN-CVE-2026-102633
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:88247 8.2

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:88247
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:88248 8.2

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:88248
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:92323 8.2

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92323
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-102633 8.2

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
UBUNTU-CVE-2026-102633
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
OSVALSA-2026:88247 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:88247
Updated
2026-11-02
OSVALSA-2026:88248 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:88248
Updated
2026-11-02
OSVALSA-2026:92323 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92323
Updated
2026-11-02
OSVAZL-105048 No score

CVE-2026-102633 affecting package expat 2.8.3-2

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Record
AZL-105048
Updated
2026-11-02
OSVCLSA-2026-1791196479 No score

expat: Fix of 2 CVEs

  • CVE-2026-102633: reject a size that would overflow the allocation in expat_realloc() instead of relying on an assert that release builds compile out
Record
CLSA-2026-1791196479
Updated
2026-11-02
OSVCLSA-2026-1791791753 No score

expat: Fix of 2 CVEs

  • CVE-2026-102633: reject a size that would overflow the allocation in expat_realloc() instead of relying on an assert that release builds compile out
Record
CLSA-2026-1791791753
Updated
2026-11-02
OSVopenSUSE-SU-2026:11981-1 No score

expat-2.8.5-1.1 on GA media

These are all security issues fixed in the expat-2.8.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11981-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22177-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
Record
openSUSE-SU-2026:22177-1
Updated
2026-11-02
OSVSUSE-SU-2026:24323-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:24323-1
Updated
2026-11-02
OSVSUSE-SU-2026:24460-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
Record
SUSE-SU-2026:24460-1
Updated
2026-11-02
OSVSUSE-SU-2026:24469-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
Record
SUSE-SU-2026:24469-1
Updated
2026-11-04
OSVSUSE-SU-2026:24554-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2) …
Record
SUSE-SU-2026:24554-1
Updated
2026-11-07
OSVSUSE-SU-2026:4615-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:4615-1
Updated
2026-11-02
OSVSUSE-SU-2026:4619-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix a class of false positives where input should have been rejected with error XML_ERROR_ASYNC_ENTITY; regression from earlier security fix (of Expat 2.7.0) …
Record
SUSE-SU-2026:4619-1
Updated
2026-11-02
OSVSUSE-SU-2026:4623-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:4623-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.21
 before 2.9.0-r0
2.9.0-r0
expat
Alpine:v3.22
 before 2.9.0-r0
2.9.0-r0
expat
Alpine:v3.23
 before 2.9.0-r0
2.9.0-r0
expat
Alpine:v3.24
 before 2.9.0-r0
2.9.0-r0
expat
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.5.0-6.el9_8.7
2.5.0-6.el9_8.7
expat-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.5.0-6.el9_8.7
2.5.0-6.el9_8.7
expat
AlmaLinux:10
From an advisory covering 2 CVEs
 before 2.7.3-1.el10_2.7
2.7.3-1.el10_2.7
expat
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.5.0-6.el8_10
2.5.0-6.el8_10
expat-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.5.0-6.el8_10
2.5.0-6.el8_10
expat
Azure Linux:3
 through 2.8.3-2 None known
Show 98 moreShow less
Affected packages
PackageAffectedFixed
expat
Alpaquita:23
 2.5.0-r0 up to 2.9.0-r0
2.9.0-r0
expat
Alpaquita:25
 2.7.1-r0 up to 2.9.0-r0
2.9.0-r0
expat
Alpaquita:stream
 2.4.9-r0 up to 2.9.0-r0
2.9.0-r0
expat
BellSoft Hardened Containers:23
 2.5.0-r0 up to 2.9.0-r0
2.9.0-r0
expat
BellSoft Hardened Containers:25
 2.7.1-r0 up to 2.9.0-r0
2.9.0-r0
expat
BellSoft Hardened Containers:stream
 2.4.9-r0 up to 2.9.0-r0
2.9.0-r0
expat
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9_2.tuxcare.els18
2.5.0-1.el9_2.tuxcare.els18
expat-devel
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9_2.tuxcare.els18
2.5.0-1.el9_2.tuxcare.els18
expat-static
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9_2.tuxcare.els18
2.5.0-1.el9_2.tuxcare.els18
expat
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els15
2.5.0-5.el9_6.tuxcare.els15
expat-devel
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els15
2.5.0-5.el9_6.tuxcare.els15
expat-static
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els15
2.5.0-5.el9_6.tuxcare.els15
expat
Debian:12
 before 2.5.0-1+deb12u5, plus listed versions
2.5.0-12.5.0-1+deb12u12.5.0-1+deb12u22.5.0-1+deb12u32.5.0-1+deb12u4
2.5.0-1+deb12u5
expat
Debian:13
 before 2.9.0-1~deb13u1, plus listed versions
2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-1
Show 12 moreShow less
2.7.5-12.8.0-12.8.0-22.8.1-12.8.2-12.8.2-1~deb13u12.8.3-12.8.3-1~deb13u12.8.4-12.8.4-22.8.5-12.8.5-2
2.9.0-1~deb13u1
expat
Debian:14
 before 2.8.5-2, plus listed versions
2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-1
Show 11 moreShow less
2.7.5-12.8.0-12.8.0-22.8.1-12.8.2-12.8.2-1~deb13u12.8.3-12.8.3-1~deb13u12.8.4-12.8.4-22.8.5-1
2.8.5-2
expat
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2.5.0-6.el9_8.7
0:2.5.0-6.el9_8.7
expat
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:2.7.3-1.el10_2.7
0:2.7.3-1.el10_2.7
expat
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.5.0-6.el8_10
0:2.5.0-6.el8_10
expat
SUSE:Linux Micro 6.0
From an advisory covering 34 CVEs
 before 2.8.5-159998.1.1
2.8.5-159998.1.1
expat
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1
expat
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1
expat
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1
expat
SUSE:Linux Micro 6.1
From an advisory covering 29 CVEs
 before 2.8.5-slfo.1.1_1.1
2.8.5-slfo.1.1_1.1
expat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 29 CVEs
 before 2.8.5-150700.3.15.1
2.8.5-150700.3.15.1
expat
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
expat
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3
Show 12 moreShow less
2.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm22.1.0-4ubuntu1.4+esm42.1.0-4ubuntu1.4+esm62.1.0-4ubuntu1.4+esm72.1.0-4ubuntu1.4+esm82.1.0-4ubuntu1.4+esm92.1.0-4ubuntu1.4+esm102.1.0-4ubuntu1.4+esm112.1.0-4ubuntu1.4+esm122.1.0-4ubuntu1.4+esm13
 None known
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
vtk
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1
 None known
xmlrpc-c
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1
 None known
expat
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.4
Show 12 moreShow less
2.1.0-7ubuntu0.16.04.52.1.0-7ubuntu0.16.04.5+esm22.1.0-7ubuntu0.16.04.5+esm52.1.0-7ubuntu0.16.04.5+esm62.1.0-7ubuntu0.16.04.5+esm72.1.0-7ubuntu0.16.04.5+esm82.1.0-7ubuntu0.16.04.5+esm92.1.0-7ubuntu0.16.04.5+esm102.1.0-7ubuntu0.16.04.5+esm112.1.0-7ubuntu0.16.04.5+esm122.1.0-7ubuntu0.16.04.5+esm132.1.0-7ubuntu0.16.04.5+esm14
 None known
ayttm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.6.3-3build10.6.3-3ubuntu0.1~esm1
 None known
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
cadaver
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu2
 None known
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
gdcm
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.4-42.4.4-4build12.4.4-4ubuntu12.6.1-32.6.2-1
Show 7 moreShow less
2.6.2-22.6.2-32.6.3-12.6.3-1ubuntu12.6.3-2ubuntu12.6.3-3ubuntu12.6.3-3ubuntu3
 None known
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
libxmltok
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.2-3build31.2-3ubuntu0.1~esm11.2-3ubuntu0.16.04.1~esm11.2-3ubuntu0.16.04.1~esm21.2-3ubuntu0.16.04.1~esm31.2-3ubuntu0.16.04.1~esm41.2-3ubuntu0.16.04.1~esm5
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
smart
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1
 None known
tdom
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8.3-1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
vtk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1
 None known
wbxml2
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.7-1
 None known
xmlrpc-c
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1
 None known
expat
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.1
Show 10 moreShow less
2.2.5-3ubuntu0.22.2.5-3ubuntu0.42.2.5-3ubuntu0.72.2.5-3ubuntu0.82.2.5-3ubuntu0.92.2.5-3ubuntu0.9+esm12.2.5-3ubuntu0.9+esm22.2.5-3ubuntu0.9+esm32.2.5-3ubuntu0.9+esm42.2.5-3ubuntu0.9+esm5
 None known
cadaver
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu3
 None known
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
gdcm
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.2-3build12.8.3-12.8.4-12.8.4-1build2
 None known
insighttoolkit4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-1ubuntu1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.18.04.1~esm11.2-4ubuntu0.18.04.1~esm21.2-4ubuntu0.18.04.1~esm31.2-4ubuntu0.18.04.1~esm41.2-4ubuntu0.18.04.1~esm51.2-4ubuntu0.18.04.1~esm61.2-4ubuntu0.18.04.1~esm7
 None known
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
smart
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.7-5ubuntu12.4.7-5ubuntu1+esm1
 None known
tdom
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.8.3-10.9.0-1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
wbxml2
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.7-10.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1
 None known
expat
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.7-22.2.9-12.2.9-1build12.2.9-1ubuntu0.22.2.9-1ubuntu0.4
Show 7 moreShow less
2.2.9-1ubuntu0.52.2.9-1ubuntu0.62.2.9-1ubuntu0.72.2.9-1ubuntu0.82.2.9-1ubuntu0.8+esm12.2.9-1ubuntu0.8+esm22.2.9-1ubuntu0.8+esm3
 None known
cadaver
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
insighttoolkit4
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-4.1ubuntu14.13.2-dfsg1-1ubuntu14.13.2-dfsg1-4ubuntu14.13.2-dfsg1-64.13.2-dfsg1-6ubuntu14.13.2-dfsg1-8
 None known
libxmltok
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.20.04.1~esm11.2-4ubuntu0.20.04.1~esm21.2-4ubuntu0.20.04.1~esm31.2-4ubuntu0.20.04.1~esm41.2-4ubuntu0.20.04.1~esm51.2-4ubuntu0.20.04.1~esm61.2-4ubuntu0.20.04.1~esm7
 None known
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
swish-e
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1
 None known
tdom
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.1-1
 None known
wbxml2
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1
 None known
insighttoolkit4
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.13.3withdata-dfsg1-4.14.13.3withdata-dfsg2-1ubuntu1
 None known
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
expat
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.5.0-22.6.0-12.6.1-22.6.1-2build12.6.1-2ubuntu0.1
Show 5 moreShow less
2.6.1-2ubuntu0.22.6.1-2ubuntu0.32.6.1-2ubuntu0.42.6.1-2ubuntu0.52.6.1-2ubuntu0.6
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
cadaver
Ubuntu:26.10
 All versions, plus listed versions
0.28+dfsg-2
 None known
expat
Ubuntu:26.10
 All versions, plus listed versions
2.7.4-12.8.1-12.8.2-12.8.3-12.8.3-1ubuntu1
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
tdom
Ubuntu:26.10
 All versions, plus listed versions
0.9.6-20.9.6-3
 None known
wbxml2
Ubuntu:26.10
 All versions, plus listed versions
0.11.10+dfsg-30.11.10+dfsg-4
 None known
xmlrpc-c
Ubuntu:26.10
 All versions, plus listed versions
1.60.05-11.60.05-1build1
 None known
cadaver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.26+dfsg-20.28+dfsg-10.28+dfsg-2
 None known
expat
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.7.1-22.7.3-12.7.4-12.7.4-1ubuntu0.12.7.4-1ubuntu0.2
 None known
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
expat
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.8.5-1.1
2.8.5-1.1
expat
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affectedOSV
affected
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-102633 is a high vulnerability (CVSS 8.2) in Libexpat, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in expat 2.9.0-r0.

References

Show 86 moreShow less
This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open