CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.(CVE-2026-93990)

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.(CVE-2026-93990)

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.(CVE-2026-93990)

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.(CVE-2026-93990)

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)

• expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)

• expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)

• expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)
• expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)
• expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: Expat: Denial of Service via quadratic complexity in attribute processing (CVE-2026-66046)
• expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in lib/xmltok.c, so a lone high surrogate can no longer consume the following code unit as a fake low surrogate and hide markup from the parser

• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so a lone high surrogate can no longer consume the next code unit as a fake low and hide markup such as '<' from the tokenizer

• SECURITY UPDATE: quadratic runtime in the default-attribute lookup of storeAtts(), and an out-of-bounds read in the same lookup for parsers created by XML_ExternalEntityParserCreate()
  • debian/patches/CVE-2026-66046.patch: in lib/xmlparse.c, replace the linear scan over ELEMENT_TYPE.defaultAtts in storeAtts() with a lookup in the already-present defaultAttForName hash table, and make dtdCopy() create NAME_AND_DEFAULT_ATTRIBUTE-sized entries so storeAtts() no longer reads member .attIndex past the end of an entry.
  • CVE-2026-66046
• SECURITY UPDATE: a UTF-16 high surrogate not followed by a low surrogate was accepted, letting the high surrogate swallow the following code unit and hide it from the tokenizer
  • debian/patches/CVE-2026-93990.patch: in lib/xmltok.c, add LITTLE2_IS_INVALID_CHAR() / BIG2_IS_INVALID_CHAR() and wire them into IS_INVALID_CHAR() for the little2_/big2_ tokenizers, so INVALID_LEAD_CASE() in lib/xmltok_impl.c rejects a 4-byte UTF-16 character whose second code unit is not U+DC00..U+DFFF; drop the now unreachable IS_INVALID_CHAR() no-op fallback in lib/xmltok_impl.c.
  • CVE-2026-93990

• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in lib/xmltok.c, so a lone high surrogate can no longer consume the following code unit as a fake low surrogate and hide markup from the parser

• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in lib/xmltok.c, so a lone high surrogate can no longer consume the following code unit as a fake low surrogate and hide markup from the parser

• SECURITY UPDATE: denial of service through quadratic runtime in the default-attribute lookup performed by storeAtts()
  • debian/patches/CVE-2026-66046.patch: resolve the CDATA-ness of a specified attribute through the per-element defaultAttForName hash table instead of a linear scan of defaultAtts, and fold in the upstream follow-up that makes dtdCopy create entries of the same size so storeAtts does not read .attIndex out of bounds (libexpat PR #1321, PR #1331).
  • CVE-2026-66046
• SECURITY UPDATE: malformed UTF-16 accepted because a high surrogate was not required to be followed by a low surrogate
  • debian/patches/CVE-2026-93990.patch: reject a 4-byte UTF-16 sequence whose second code unit is not a low surrogate, in both the little2_ and big2_ tokenizers (libexpat PR #1282).
  • CVE-2026-93990

• CVE-2026-66046: replace the linear scan of elementType->defaultAtts in storeAtts() with a hash table lookup, and carry the attribute index over in dtdCopy() so the lookup stays in bounds
• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so a lone high surrogate can no longer consume the next code unit as a fake low and hide markup such as '<' from the tokenizer

• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide the following code unit from the tokenizer

• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide the following code unit from the tokenizer

• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide the following code unit from the tokenizer

• SECURITY UPDATE: denial of service through quadratic runtime in the default-attribute lookup performed by storeAtts()
  • debian/patches/CVE-2026-66046.patch: resolve whether an attribute is declared CDATA through the per-element defaultAttsNames hash table instead of a linear scan of defaultAtts in expat/lib/xmlparse.c
  • CVE-2026-66046
• SECURITY UPDATE: out-of-bounds read of .attIndex in storeAtts() for parsers created by XML_ExternalEntityParserCreate()
  • debian/patches/CVE-2026-76641.patch: make dtdCopy() create the defaultAttsNames entries with the size of NAME_AND_DEFAULT_ATTRIBUTE and carry the attribute index over in expat/lib/xmlparse.c
  • CVE-2026-76641
• SECURITY UPDATE: malformed UTF-16 accepted because a high surrogate was not required to be followed by a low surrogate
  • debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate in the little2_ and big2_ tokenizers in expat/lib/xmltok.c and expat/lib/xmltok_impl.c
  • CVE-2026-93990

• SECURITY UPDATE: XML injection via malformed UTF-16 input: a high surrogate not followed by a low surrogate is accepted and consumes the following code unit, hiding markup characters from the parser (libexpat through 2.8.4)
  • debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose second code unit is not a low surrogate by defining IS_INVALID_CHAR (and isInvalid4 for XML_MIN_SIZE) for the little2_/big2_ encodings; also carries upstream's regression test into tests/runtests.c
  • CVE-2026-93990
• SECURITY UPDATE: Denial of service via quadratic complexity in storeAtts(), which scanned elementType->defaultAtts linearly to determine the CDATA status of every non-normalized attribute (libexpat through 2.8.3)
  • debian/patches/CVE-2026-66046.patch: store the index of the first default attribute declaration in the per-element hash table and use a hash lookup instead of the linear scan; includes upstream's follow-up for dtdCopy() so that external entity parsers do not read past the hash table entries
  • CVE-2026-66046

• CVE-2026-66046: fix quadratic runtime in storeAtts() by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes
• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide markup characters from the tokenizer

• CVE-2026-66046: fix quadratic runtime in storeAtts() by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes
• CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide markup characters from the tokenizer

These are all security issues fixed in the expat-2.8.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):

• CVE-2026-109704: Privilege escalation in the Application Update component.
• CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component.
• CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
• CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
• CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
• CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.
• CVE-2026-109710: Use-after-free in the Graphics: Text component.
• CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
• CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.
• CVE-2026-109713: Use-after-free in the Crash Reporting component.
• CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.
• CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.
• CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
• CVE-2026-109718: Use-after-free in the XML component.
• CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.
• CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.
• CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.
• CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
• CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
• CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
• CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
• CVE-2026-109726: Use-after-free in the SVG component.
• CVE-2026-109727: Use-after-free in the Audio/Video component.
• CVE-2026-109728: Use-after-free in the DOM: Animation component.
• CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
• CVE-2026-109730: Integer overflow in the Graphics component.
• CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.
• CVE-2026-109732: Use-after-free in the DOM: Streams component.
• CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
• CVE-2026-109734: Mitigation bypass in the DOM: Security component.
• CVE-2026-109736: Frame poisoning in the Layout component.
• CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
• CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
• CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
• CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.
• CVE-2026-109742: Information disclosure in the PDF Viewer component.
• CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
• CVE-2026-109744: Other issue in the DOM: File component.
• CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
• CVE-2026-109751: Information disclosure in the Networking component.
• CVE-2026-109752: Use-after-free in the DOM: Workers component.
• CVE-2026-109753: Incorrect boundary conditions in the Layout component.
• CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
• CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
• CVE-2026-109757: Sandbox escape due to race condition in the Networking component.
• CVE-2026-109759: Site isolation issue in the Networking component.
• CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
• CVE-2026-109762: Incorrect boundary conditions in the SVG component.
• CVE-2026-109763: Mitigation bypass in the File Handling component.
• CVE-2026-109764: Mitigation bypass in the Enterprise Policies component. -…

This update for expat fixes the following issues:

• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated

Root has patched CVE-2026-93990 in the expat package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-93990 in the expat package for Root:Debian:13. Multiple fixed versions available.

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):

• CVE-2026-109704: Privilege escalation in the Application Update component.
• CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component.
• CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
• CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
• CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
• CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.
• CVE-2026-109710: Use-after-free in the Graphics: Text component.
• CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
• CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.
• CVE-2026-109713: Use-after-free in the Crash Reporting component.
• CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.
• CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.
• CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
• CVE-2026-109718: Use-after-free in the XML component.
• CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.
• CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.
• CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.
• CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
• CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
• CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
• CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
• CVE-2026-109726: Use-after-free in the SVG component.
• CVE-2026-109727: Use-after-free in the Audio/Video component.
• CVE-2026-109728: Use-after-free in the DOM: Animation component.
• CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
• CVE-2026-109730: Integer overflow in the Graphics component.
• CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.
• CVE-2026-109732: Use-after-free in the DOM: Streams component.
• CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
• CVE-2026-109734: Mitigation bypass in the DOM: Security component.
• CVE-2026-109736: Frame poisoning in the Layout component.
• CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
• CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
• CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
• CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.
• CVE-2026-109742: Information disclosure in the PDF Viewer component.
• CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
• CVE-2026-109744: Other issue in the DOM: File component.
• CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
• CVE-2026-109751: Information disclosure in the Networking component.
• CVE-2026-109752: Use-after-free in the DOM: Workers component.
• CVE-2026-109753: Incorrect boundary conditions in the Layout component.
• CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
• CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
• CVE-2026-109757: Sandbox escape due to race condition in the Networking component.
• CVE-2026-109759: Site isolation issue in the Networking component.
• CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
• CVE-2026-109762: Incorrect boundary conditions in the SVG component.
• CVE-2026-109763: Mitigation bypass in the File Handling component.
• CVE-2026-109764: Mitigation bypass in the Enterprise Policies component. -…

This update for expat fixes the following issues:

• CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
• CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
• CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
• CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
• CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
• CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
• CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
• CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
• CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
• CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
• CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
• CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
• CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
• CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
• CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
• CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
• CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated
• CMake: only add /source-charset:utf-8 when /utf-8 is not present
• lib: resolve undefined behavior from overshifting a signed int
• lib: support read-only hash table lookup with non-zero-terminated keys
• lib: use a C99 bool for ENTITY.open
• version info bumped from 13:3:12 to 13:4:12
• fix support for 2+ GiB documents (regression from 2.8.2)
• reject empty version in the XML declaration
• fix printf format for AIX
• CMake|AIX: enable EXPAT_DEV_URANDOM by default
• version info bumped from 13:2:12 to 13:3:12
• Existing API function XML_SetHashSalt is now deprecated
• because of its limitations, and its use should be
• considered a vulnerability. Please either use the new API
• function XML_SetHashSalt16Bytes (with known-high-quality
• entropy input only!) instead, or leave the derivation of
• a 16-bytes hash salt from high quality entropy to Expat's
• internal machinery (by not calling either of the two
• XML_SetHashSalt* functions).
• xmlwf: Fix a memory leak
• WASI: Fix format specifiers for 32bit WASI SDK
• Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
• Fix a class of…

This update for expat fixes the following issues:

• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated

This update for expat fixes the following issues:

• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated

This update for expat fixes the following issues:

• CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
• CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
• CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
• CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
• CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
• CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
• CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
• CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
• CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
• CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
• CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
• CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
• CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
• CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
• CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
• CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
• CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated
• CMake: only add /source-charset:utf-8 when /utf-8 is not present
• lib: resolve undefined behavior from overshifting a signed int
• lib: support read-only hash table lookup with non-zero-terminated keys
• lib: use a C99 bool for ENTITY.open
• version info bumped from 13:3:12 to 13:4:12
• fix support for 2+ GiB documents (regression from 2.8.2)
• reject empty version in the XML declaration
• fix printf format for AIX
• CMake|AIX: enable EXPAT_DEV_URANDOM by default
• version info bumped from 13:2:12 to 13:3:12
• Existing API function XML_SetHashSalt is now deprecated
• because of its limitations, and its use should be
• considered a vulnerability. Please either use the new API
• function XML_SetHashSalt16Bytes (with known-high-quality
• entropy input only!) instead, or leave the derivation of
• a 16-bytes hash salt from high quality entropy to Expat's
• internal machinery (by not calling either of the two
• XML_SetHashSalt* functions).
• xmlwf: Fix a memory leak
• WASI: Fix format specifiers for 32bit WASI SDK
• Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2) …

This update for expat fixes the following issues:

• CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
• CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
• CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
• CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
• CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
• CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
• CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
• CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
• CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
• CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
• CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
• CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
• CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
• CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
• CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
• CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
• CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated
• CMake: only add /source-charset:utf-8 when /utf-8 is not present
• lib: resolve undefined behavior from overshifting a signed int
• lib: support read-only hash table lookup with non-zero-terminated keys
• lib: use a C99 bool for ENTITY.open
• version info bumped from 13:3:12 to 13:4:12
• fix support for 2+ GiB documents (regression from 2.8.2)
• reject empty version in the XML declaration
• fix printf format for AIX
• CMake|AIX: enable EXPAT_DEV_URANDOM by default
• version info bumped from 13:2:12 to 13:3:12
• Existing API function XML_SetHashSalt is now deprecated
• because of its limitations, and its use should be
• considered a vulnerability. Please either use the new API
• function XML_SetHashSalt16Bytes (with known-high-quality
• entropy input only!) instead, or leave the derivation of
• a 16-bytes hash salt from high quality entropy to Expat's
• internal machinery (by not calling either of the two
• XML_SetHashSalt* functions).
• xmlwf: Fix a memory leak
• WASI: Fix format specifiers for 32bit WASI SDK
• Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
• Fix a class of…

This update for expat fixes the following issues:

• CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
• CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
• CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
• CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
• CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
• CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
• CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
• CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
• CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
• CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
• CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
• CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
• CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
• CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
• CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
• CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
• CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated
• CMake: only add /source-charset:utf-8 when /utf-8 is not present
• lib: resolve undefined behavior from overshifting a signed int
• lib: support read-only hash table lookup with non-zero-terminated keys
• lib: use a C99 bool for ENTITY.open
• version info bumped from 13:3:12 to 13:4:12
• fix support for 2+ GiB documents (regression from 2.8.2)
• reject empty version in the XML declaration
• fix printf format for AIX
• CMake|AIX: enable EXPAT_DEV_URANDOM by default
• version info bumped from 13:2:12 to 13:3:12
• Existing API function XML_SetHashSalt is now deprecated
• because of its limitations, and its use should be
• considered a vulnerability. Please either use the new API
• function XML_SetHashSalt16Bytes (with known-high-quality
• entropy input only!) instead, or leave the derivation of
• a 16-bytes hash salt from high quality entropy to Expat's
• internal machinery (by not calling either of the two
• XML_SetHashSalt* functions).
• xmlwf: Fix a memory leak
• WASI: Fix format specifiers for 32bit WASI SDK
• Fix a class of false positives where input should have been rejected with error XML_ERROR_ASYNC_ENTITY; regression from earlier security fix (of Expat 2.7.0) …

This update for expat fixes the following issues:

• CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
• CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
• CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
• CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
• CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
• CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
• CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
• CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
• CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
• CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
• CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
• CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
• CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
• CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
• CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
• CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
• CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
• CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
• CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
• CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

• Bug fixes:
• Fix an OOM-related memory leak on a failed overflow check
• Fix memory alignment for architectures with 128bit pointers
• Mark XML_SetHashSalt deprecated
• CMake: only add /source-charset:utf-8 when /utf-8 is not present
• lib: resolve undefined behavior from overshifting a signed int
• lib: support read-only hash table lookup with non-zero-terminated keys
• lib: use a C99 bool for ENTITY.open
• version info bumped from 13:3:12 to 13:4:12
• fix support for 2+ GiB documents (regression from 2.8.2)
• reject empty version in the XML declaration
• fix printf format for AIX
• CMake|AIX: enable EXPAT_DEV_URANDOM by default
• version info bumped from 13:2:12 to 13:3:12
• Existing API function XML_SetHashSalt is now deprecated
• because of its limitations, and its use should be
• considered a vulnerability. Please either use the new API
• function XML_SetHashSalt16Bytes (with known-high-quality
• entropy input only!) instead, or leave the derivation of
• a 16-bytes hash salt from high quality entropy to Expat's
• internal machinery (by not calling either of the two
• XML_SetHashSalt* functions).
• xmlwf: Fix a memory leak
• WASI: Fix format specifiers for 32bit WASI SDK
• Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
• Fix a class of…