Every CVE Search/ Get API key

CVE-2026-77214

libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer

8.3 HighFix available

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
Low

Exploit likelihood

0.32%Down 0.2 points since Oct 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.3

libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
CVE-2026-77214
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2026-94368 8.3

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
EUVD-2026-94368
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8xfx-9m5m-pgcp 8.3

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c....

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
GHSA-8xfx-9m5m-pgcp
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
NVD 8.3

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
CVE-2026-77214
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2026-77214 8.3

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
ALPINE-CVE-2026-77214
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-77214 8.2
Record
BELL-CVE-2026-77214
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
Show 30 moreShow less
OSV 8.3

libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
CVE-2026-77214
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-125
Updated
2026-11-07
OSVDEBIAN-CVE-2026-77214 8.3

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
DEBIAN-CVE-2026-77214
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-4348 8.2

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)

Record
OESA-2026-4348
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4349 8.2

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)

Record
OESA-2026-4349
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4350 8.2

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)

Record
OESA-2026-4350
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVOESA-2026-4351 8.2

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)

Record
OESA-2026-4351
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:77959 8.2

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:77959
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:88247 8.2

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:88247
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:88248 8.2

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:88248
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:89758 8.2

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)

  • firefox: Use-after-free in the XML component (CVE-2026-109718)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)

  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)

  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)

  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)

  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)

  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)

  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)

  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)

  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)

  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)

  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)

  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)

  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)

  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)

  • firefox: Use-after-free in the SVG component (CVE-2026-109726)

  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)

  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)

  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)

  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)

  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)

  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)

  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)

  • firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)

  • firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)

Bug Fix(es) and Enhancement(s):

  • Firefox ESR 153 rebase [rhel-10.2.z] (JIRA:Rocky Linux-175166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89758
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:92323 8.2

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)

  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:92323
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-77214 8.3

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
UBUNTU-CVE-2026-77214
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Updated
2026-11-02
OSVALSA-2026:88247 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:88247
Updated
2026-11-02
OSVALSA-2026:88248 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:88248
Updated
2026-11-02
OSVALSA-2026:89758 No score

Important: firefox security, bug fix, and enhancement update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libexpat: denial of service via crafted XML input (CVE-2026-45186)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)
  • firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)
  • firefox: Use-after-free in the XML component (CVE-2026-109718)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)
  • firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)
  • firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)
  • firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)
  • firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)
  • firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)
  • firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)
  • firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)
  • firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)
  • firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)
  • firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)
  • firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)
  • firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)
  • firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)
  • firefox: Use-after-free in the SVG component (CVE-2026-109726)
  • firefox: Integer overflow in the Graphics component (CVE-2026-109730)
  • firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)
  • firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)
  • firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)
  • firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)
  • firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)
  • firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)
  • firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)
  • firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)

Bug Fix(es) and Enhancement(s):

  • Firefox ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89758
Updated
2026-11-04
OSVALSA-2026:92323 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:92323
Updated
2026-11-02
OSVAZL-106728 No score

CVE-2026-77214 affecting package expat for versions less than 2.9.0-1

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
AZL-106728
Updated
2026-11-02
OSVAZL-107228 No score

CVE-2026-77214 affecting package cmake 3.30.3-15

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Record
AZL-107228
Updated
2026-11-02
OSVCLSA-2026-1792993465 No score

expat: Fix of CVE-2026-77214

  • CVE-2026-77214: reject XML_ParseBuffer lengths larger than the space left in the internal buffer
Record
CLSA-2026-1792993465
Updated
2026-11-02
OSVopenSUSE-SU-2026:12100-1 No score

expat-2.9.0-1.1 on GA media

These are all security issues fixed in the expat-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12100-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22177-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
Record
openSUSE-SU-2026:22177-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-77214 No score

CVE-2026-77214 in expat - Patched by Root

Root has patched CVE-2026-77214 in the expat package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-77214
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-77214 No score

CVE-2026-77214 in expat - Patched by Root

Root has patched CVE-2026-77214 in the expat package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-77214
Updated
2026-11-02
OSVSUSE-SU-2026:24323-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:24323-1
Updated
2026-11-02
OSVSUSE-SU-2026:24460-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
Record
SUSE-SU-2026:24460-1
Updated
2026-11-02
OSVSUSE-SU-2026:24469-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
Record
SUSE-SU-2026:24469-1
Updated
2026-11-04
OSVSUSE-SU-2026:24554-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2) …
Record
SUSE-SU-2026:24554-1
Updated
2026-11-07
OSVSUSE-SU-2026:4615-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:4615-1
Updated
2026-11-02
OSVSUSE-SU-2026:4619-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix a class of false positives where input should have been rejected with error XML_ERROR_ASYNC_ENTITY; regression from earlier security fix (of Expat 2.7.0) …
Record
SUSE-SU-2026:4619-1
Updated
2026-11-02
OSVSUSE-SU-2026:4623-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:4623-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.21
 before 2.9.0-r0
2.9.0-r0
expat
Alpine:v3.22
 before 2.9.0-r0
2.9.0-r0
expat
Alpine:v3.23
 before 2.9.0-r0
2.9.0-r0
expat
Alpine:v3.24
 before 2.9.0-r0
2.9.0-r0
expat
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.5.0-6.el9_8.7
2.5.0-6.el9_8.7
expat-devel
AlmaLinux:9
From an advisory covering 2 CVEs
 before 2.5.0-6.el9_8.7
2.5.0-6.el9_8.7
expat
AlmaLinux:10
From an advisory covering 2 CVEs
 before 2.7.3-1.el10_2.7
2.7.3-1.el10_2.7
firefox
AlmaLinux:10
From an advisory covering 29 CVEs
 before 153.5.0-1.el10_2
153.5.0-1.el10_2
expat
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.5.0-6.el8_10
2.5.0-6.el8_10
expat-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 2.5.0-6.el8_10
2.5.0-6.el8_10
Show 121 moreShow less
Affected packages
PackageAffectedFixed
expat
Azure Linux:3
 before 2.9.0-1
2.9.0-1
cmake
Azure Linux:3
 through 3.30.3-15 None known
expat
Alpaquita:23
 2.5.0-r0 up to 2.9.0-r0
2.9.0-r0
expat
Alpaquita:25
 2.7.1-r0 up to 2.9.0-r0
2.9.0-r0
expat
Alpaquita:stream
 2.4.9-r0 up to 2.9.0-r0
2.9.0-r0
expat
BellSoft Hardened Containers:23
 2.5.0-r0 up to 2.9.0-r0
2.9.0-r0
expat
BellSoft Hardened Containers:25
 2.7.1-r0 up to 2.9.0-r0
2.9.0-r0
expat
BellSoft Hardened Containers:stream
 2.4.9-r0 up to 2.9.0-r0
2.9.0-r0
expat
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els15
2.0.1-13.el6_8.tuxcare.els15
expat-devel
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els15
2.0.1-13.el6_8.tuxcare.els15
expat
Debian:12
 before 2.5.0-1+deb12u5, plus listed versions
2.5.0-12.5.0-1+deb12u12.5.0-1+deb12u22.5.0-1+deb12u32.5.0-1+deb12u4
2.5.0-1+deb12u5
expat
Debian:13
 before 2.9.0-1~deb13u1, plus listed versions
2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-1
Show 12 moreShow less
2.7.5-12.8.0-12.8.0-22.8.1-12.8.2-12.8.2-1~deb13u12.8.3-12.8.3-1~deb13u12.8.4-12.8.4-22.8.5-12.8.5-2
2.9.0-1~deb13u1
expat
Debian:14
 before 2.9.0-1, plus listed versions
2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-1
Show 13 moreShow less
2.7.5-12.8.0-12.8.0-22.8.1-12.8.2-12.8.2-1~deb13u12.8.3-12.8.3-1~deb13u12.8.4-12.8.4-22.8.5-12.8.5-22.9.0-1~deb13u1
2.9.0-1
expat
openEuler:22.03-LTS-SP4
 before 2.4.1-33.oe2203sp4
2.4.1-33.oe2203sp4
expat
openEuler:24.03-LTS-SP1
 before 2.5.0-29.oe2403sp1
2.5.0-29.oe2403sp1
expat
openEuler:24.03-LTS-SP3
 before 2.5.0-29.oe2403sp3
2.5.0-29.oe2403sp3
expat
openEuler:24.03-LTS-SP4
 before 2.8.1-10.oe2403sp4
2.8.1-10.oe2403sp4
expat
Red Hat:hummingbird:1
 before 0:2.8.5-1.2.hum1
0:2.8.5-1.2.hum1
expat-devel
Red Hat:hummingbird:1
 before 0:2.8.5-1.2.hum1
0:2.8.5-1.2.hum1
expat-static
Red Hat:hummingbird:1
 before 0:2.8.5-1.2.hum1
0:2.8.5-1.2.hum1
expat
Rocky Linux:9
From an advisory covering 2 CVEs
 before 0:2.5.0-6.el9_8.7
0:2.5.0-6.el9_8.7
expat
Rocky Linux:10
From an advisory covering 2 CVEs
 before 0:2.7.3-1.el10_2.7
0:2.7.3-1.el10_2.7
firefox
Rocky Linux:10
From an advisory covering 29 CVEs
 before 0:153.5.0-1.el10_2
0:153.5.0-1.el10_2
expat
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:2.5.0-6.el8_10
0:2.5.0-6.el8_10
expat
SUSE:Linux Micro 6.0
From an advisory covering 34 CVEs
 before 2.8.5-159998.1.1
2.8.5-159998.1.1
expat
SUSE:Linux Micro 6.2
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1
expat
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1
expat
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1
expat
SUSE:Linux Micro 6.1
From an advisory covering 29 CVEs
 before 2.8.5-slfo.1.1_1.1
2.8.5-slfo.1.1_1.1
expat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 29 CVEs
 before 2.8.5-150700.3.15.1
2.8.5-150700.3.15.1
expat
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
expat
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3
Show 12 moreShow less
2.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm22.1.0-4ubuntu1.4+esm42.1.0-4ubuntu1.4+esm62.1.0-4ubuntu1.4+esm72.1.0-4ubuntu1.4+esm82.1.0-4ubuntu1.4+esm92.1.0-4ubuntu1.4+esm102.1.0-4ubuntu1.4+esm112.1.0-4ubuntu1.4+esm122.1.0-4ubuntu1.4+esm13
 None known
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
vtk
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1
 None known
xmlrpc-c
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1
 None known
expat
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.4
Show 12 moreShow less
2.1.0-7ubuntu0.16.04.52.1.0-7ubuntu0.16.04.5+esm22.1.0-7ubuntu0.16.04.5+esm52.1.0-7ubuntu0.16.04.5+esm62.1.0-7ubuntu0.16.04.5+esm72.1.0-7ubuntu0.16.04.5+esm82.1.0-7ubuntu0.16.04.5+esm92.1.0-7ubuntu0.16.04.5+esm102.1.0-7ubuntu0.16.04.5+esm112.1.0-7ubuntu0.16.04.5+esm122.1.0-7ubuntu0.16.04.5+esm132.1.0-7ubuntu0.16.04.5+esm14
 None known
ayttm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.6.3-3build10.6.3-3ubuntu0.1~esm1
 None known
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
cadaver
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu2
 None known
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
gdcm
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.4-42.4.4-4build12.4.4-4ubuntu12.6.1-32.6.2-1
Show 7 moreShow less
2.6.2-22.6.2-32.6.3-12.6.3-1ubuntu12.6.3-2ubuntu12.6.3-3ubuntu12.6.3-3ubuntu3
 None known
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
libxmltok
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.2-3build31.2-3ubuntu0.1~esm11.2-3ubuntu0.16.04.1~esm11.2-3ubuntu0.16.04.1~esm21.2-3ubuntu0.16.04.1~esm31.2-3ubuntu0.16.04.1~esm41.2-3ubuntu0.16.04.1~esm5
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
smart
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1
 None known
tdom
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8.3-1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
vtk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1
 None known
wbxml2
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.7-1
 None known
xmlrpc-c
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1
 None known
expat
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.1
Show 10 moreShow less
2.2.5-3ubuntu0.22.2.5-3ubuntu0.42.2.5-3ubuntu0.72.2.5-3ubuntu0.82.2.5-3ubuntu0.92.2.5-3ubuntu0.9+esm12.2.5-3ubuntu0.9+esm22.2.5-3ubuntu0.9+esm32.2.5-3ubuntu0.9+esm42.2.5-3ubuntu0.9+esm5
 None known
cadaver
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu3
 None known
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
gdcm
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.2-3build12.8.3-12.8.4-12.8.4-1build2
 None known
insighttoolkit4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-1ubuntu1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.18.04.1~esm11.2-4ubuntu0.18.04.1~esm21.2-4ubuntu0.18.04.1~esm31.2-4ubuntu0.18.04.1~esm41.2-4ubuntu0.18.04.1~esm51.2-4ubuntu0.18.04.1~esm61.2-4ubuntu0.18.04.1~esm7
 None known
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
smart
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.7-5ubuntu12.4.7-5ubuntu1+esm1
 None known
tdom
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.8.3-10.9.0-1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
wbxml2
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.7-10.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1
 None known
expat
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.7-22.2.9-12.2.9-1build12.2.9-1ubuntu0.22.2.9-1ubuntu0.4
Show 7 moreShow less
2.2.9-1ubuntu0.52.2.9-1ubuntu0.62.2.9-1ubuntu0.72.2.9-1ubuntu0.82.2.9-1ubuntu0.8+esm12.2.9-1ubuntu0.8+esm22.2.9-1ubuntu0.8+esm3
 None known
cadaver
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
insighttoolkit4
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-4.1ubuntu14.13.2-dfsg1-1ubuntu14.13.2-dfsg1-4ubuntu14.13.2-dfsg1-64.13.2-dfsg1-6ubuntu14.13.2-dfsg1-8
 None known
libxmltok
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.20.04.1~esm11.2-4ubuntu0.20.04.1~esm21.2-4ubuntu0.20.04.1~esm31.2-4ubuntu0.20.04.1~esm41.2-4ubuntu0.20.04.1~esm51.2-4ubuntu0.20.04.1~esm61.2-4ubuntu0.20.04.1~esm7
 None known
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
swish-e
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1
 None known
tdom
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.1-1
 None known
wbxml2
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1
 None known
cadaver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
expat
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.4.1-22.4.1-32.4.2-12.4.3-12.4.3-2
Show 12 moreShow less
2.4.4-12.4.6-12.4.7-12.4.7-1ubuntu0.12.4.7-1ubuntu0.22.4.7-1ubuntu0.32.4.7-1ubuntu0.42.4.7-1ubuntu0.52.4.7-1ubuntu0.62.4.7-1ubuntu0.72.4.7-1ubuntu0.82.4.7-1ubuntu0.9
 None known
insighttoolkit4
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.13.3withdata-dfsg1-4.14.13.3withdata-dfsg2-1ubuntu1
 None known
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
tdom
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
wbxml2
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.10.7-1build10.11.7+dfsg-1
 None known
libxmltok
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.22.04.1~esm11.2-4ubuntu0.22.04.1~esm21.2-4ubuntu0.22.04.1~esm31.2-4ubuntu0.22.04.1~esm41.2-4ubuntu0.22.04.1~esm51.2-4ubuntu0.22.04.1~esm61.2-4ubuntu0.22.04.1~esm7
 None known
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1
 None known
cadaver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2
 None known
expat
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.5.0-22.6.0-12.6.1-22.6.1-2build12.6.1-2ubuntu0.1
Show 5 moreShow less
2.6.1-2ubuntu0.22.6.1-2ubuntu0.32.6.1-2ubuntu0.42.6.1-2ubuntu0.52.6.1-2ubuntu0.6
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
tdom
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.3-10.9.3-1build1
 None known
wbxml2
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.8+dfsg-30.11.8+dfsg-3build1
 None known
libxmltok
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.2-4ubuntu11.2-4.1ubuntu11.2-4.1ubuntu21.2-4.1ubuntu2.24.0.4.1+esm11.2-4.1ubuntu2.24.0.4.1+esm21.2-4.1ubuntu2.24.0.4.1+esm31.2-4.1ubuntu2.24.0.4.1+esm41.2-4.1ubuntu2.24.0.4.1+esm5
 None known
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1
 None known
cadaver
Ubuntu:26.10
 All versions, plus listed versions
0.28+dfsg-2
 None known
expat
Ubuntu:26.10
 All versions, plus listed versions
2.7.4-12.8.1-12.8.2-12.8.3-12.8.3-1ubuntu1
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
tdom
Ubuntu:26.10
 All versions, plus listed versions
0.9.6-20.9.6-3
 None known
wbxml2
Ubuntu:26.10
 All versions, plus listed versions
0.11.10+dfsg-30.11.10+dfsg-4
 None known
xmlrpc-c
Ubuntu:26.10
 All versions, plus listed versions
1.60.05-11.60.05-1build1
 None known
cadaver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.26+dfsg-20.28+dfsg-10.28+dfsg-2
 None known
expat
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.7.1-22.7.3-12.7.4-12.7.4-1ubuntu0.12.7.4-1ubuntu0.2
 None known
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
tdom
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.9.5.1-30.9.6-2
 None known
wbxml2
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.10+dfsg-20.11.10+dfsg-2build10.11.10+dfsg-3
 None known
xmlrpc-c
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.59.03-10.11.60.05-1
 None known
swish-e
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1
 None known
expat
openSUSE:Tumbleweed
 before 2.9.0-1.1
2.9.0-1.1
expat
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 2.8.5-160000.1.1
2.8.5-160000.1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected
affected, aliases, referencesOSV
affected, aliases, facts, referencesOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77214 is a high vulnerability (CVSS 8.3) in Libexpat, published October 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in expat 2.9.0-r0.

References

Show 162 moreShow less
This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open