{"id":"CVE-2026-56409","aliases":["ALPINE-CVE-2026-56409","AZL-90249","BELL-CVE-2026-56409","CLSA-2026-1786034306","CLSA-2026-1786451206","DEBIAN-CVE-2026-56409","EUVD-2026-38186","GHSA-jhv6-83wh-9vj5","JLSEC-2026-1233","MGASA-2026-0352","OESA-2026-2973","OESA-2026-2974","OESA-2026-2975","OESA-2026-2976","ROOT-OS-DEBIAN-11-CVE-2026-56409","ROOT-OS-DEBIAN-12-CVE-2026-56409","ROOT-OS-DEBIAN-13-CVE-2026-56409","SUSE-SU-2026:23894-1","SUSE-SU-2026:23912-1","SUSE-SU-2026:24260-1","SUSE-SU-2026:24323-1","SUSE-SU-2026:24554-1","SUSE-SU-2026:4615-1","SUSE-SU-2026:4619-1","SUSE-SU-2026:4623-1","SUSE-SU-2026:4736-1","SUSE-SU-2026:4806-1","SUSE-SU-2026:4834-1","UBUNTU-CVE-2026-56409","USN-8813-1","openSUSE-SU-2026:11584-1","openSUSE-SU-2026:21945-1","openSUSE-SU-2026:22139-1"],"status":"published","title":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir...","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00119,"percentile":0.01799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-06-21T15:52:59Z","modified":"2026-11-07T17:27:11Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.8.2-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.8.2-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.8.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.8.2+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"expat","fixed_in":["2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.aikido.20"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-expat","fixed_in":["2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.aikido.20"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm14"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.9+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.8+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.7-1ubuntu0.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"expat","fixed_in":["2.6.1-2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"expat","fixed_in":["2.7.4-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els11"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u3"}]}],"versions":["2.5.0-1","2.5.0-1+deb12u1","2.5.0-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1~deb13u1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1","2.8.2-1~deb13u1"]},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.2+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3-1.mga10"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:10","package":"mingw-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3-1.mga10"}]}],"bundled":14},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-28.oe2003sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-27.oe2203sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-23.oe2403sp1"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-22.oe2403sp3"}]}],"bundled":10},{"source":"osv","ecosystem":"Root:Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.aikido.20"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.aikido.20"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-160000.1.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-160000.1.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-159998.1.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-slfo.1.1_1.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150700.3.15.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-118.16.2"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-118.16.2"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm13"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9","2.1.0-4ubuntu1.4+esm10","2.1.0-4ubuntu1.4+esm11","2.1.0-4ubuntu1.4+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm14"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9","2.1.0-7ubuntu0.16.04.5+esm10","2.1.0-7ubuntu0.16.04.5+esm11","2.1.0-7ubuntu0.16.04.5+esm12","2.1.0-7ubuntu0.16.04.5+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4","2.4.4-4build1","2.4.4-4ubuntu1","2.6.1-3","2.6.2-1","2.6.2-2","2.6.2-3","2.6.3-1","2.6.3-1ubuntu1","2.6.3-2ubuntu1","2.6.3-3ubuntu1","2.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.1~esm1","1.2-3ubuntu0.16.04.1~esm1","1.2-3ubuntu0.16.04.1~esm2","1.2-3ubuntu0.16.04.1~esm3","1.2-3ubuntu0.16.04.1~esm4","1.2-3ubuntu0.16.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm5"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1","2.2.5-3ubuntu0.9+esm2","2.2.5-3ubuntu0.9+esm3","2.2.5-3ubuntu0.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-3build1","2.8.3-1","2.8.4-1","2.8.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2","1.2-4ubuntu0.18.04.1~esm3","1.2-4ubuntu0.18.04.1~esm4","1.2-4ubuntu0.18.04.1~esm5","1.2-4ubuntu0.18.04.1~esm6","1.2-4ubuntu0.18.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+esm3"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7","2.2.9-1ubuntu0.8","2.2.9-1ubuntu0.8+esm1","2.2.9-1ubuntu0.8+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2","1.2-4ubuntu0.20.04.1~esm3","1.2-4ubuntu0.20.04.1~esm4","1.2-4ubuntu0.20.04.1~esm5","1.2-4ubuntu0.20.04.1~esm6","1.2-4ubuntu0.20.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.9"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4","2.4.7-1ubuntu0.5","2.4.7-1ubuntu0.6","2.4.7-1ubuntu0.7","2.4.7-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.22.04.1~esm1","1.2-4ubuntu0.22.04.1~esm2","1.2-4ubuntu0.22.04.1~esm3","1.2-4ubuntu0.22.04.1~esm4","1.2-4ubuntu0.22.04.1~esm5","1.2-4ubuntu0.22.04.1~esm6","1.2-4ubuntu0.22.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.6"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1","2.6.1-2ubuntu0.2","2.6.1-2ubuntu0.3","2.6.1-2ubuntu0.4","2.6.1-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2","1.2-4.1ubuntu2.24.0.4.1+esm1","1.2-4.1ubuntu2.24.0.4.1+esm2","1.2-4.1ubuntu2.24.0.4.1+esm3","1.2-4.1ubuntu2.24.0.4.1+esm4","1.2-4.1ubuntu2.24.0.4.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","2.7.1-2","2.7.1-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1ubuntu0.2"}]}],"versions":["2.7.1-2","2.7.3-1","2.7.4-1","2.7.4-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm13"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9","2.1.0-4ubuntu1.4+esm10","2.1.0-4ubuntu1.4+esm11","2.1.0-4ubuntu1.4+esm12"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm14"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9","2.1.0-7ubuntu0.16.04.5+esm10","2.1.0-7ubuntu0.16.04.5+esm11","2.1.0-7ubuntu0.16.04.5+esm12","2.1.0-7ubuntu0.16.04.5+esm13"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm5"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1","2.2.5-3ubuntu0.9+esm2","2.2.5-3ubuntu0.9+esm3","2.2.5-3ubuntu0.9+esm4"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+esm3"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7","2.2.9-1ubuntu0.8","2.2.9-1ubuntu0.8+esm1","2.2.9-1ubuntu0.8+esm2"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.9"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4","2.4.7-1ubuntu0.5","2.4.7-1ubuntu0.6","2.4.7-1ubuntu0.7","2.4.7-1ubuntu0.8"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.6"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1","2.6.1-2ubuntu0.2","2.6.1-2ubuntu0.3","2.6.1-2ubuntu0.4","2.6.1-2ubuntu0.5"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1ubuntu0.2"}]}],"versions":["2.7.1-2","2.7.3-1","2.7.4-1","2.7.4-1ubuntu0.1"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-160000.1.1"}]}],"bundled":85}],"products":[{"vendor":"libexpat project","product":"libexpat"},{"vendor":"libexpat_project","product":"libexpat"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/1259","tags":["Patch","Issue Tracking","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56409","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-jhv6-83wh-9vj5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56409","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56409","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786034306.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56408","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786451206.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56409.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56409","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0352.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35758","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/25/10","tags":["web"]},{"url":"https://blog.hartwork.org/posts/expat-2-8-2-released/","tags":["web"]},{"url":"https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56412","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2974","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2975","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2976","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623894-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264713","tags":["report"]},{"url":"https://bugzilla.suse.com/1267631","tags":["report"]},{"url":"https://bugzilla.suse.com/1268572","tags":["report"]},{"url":"https://bugzilla.suse.com/1268573","tags":["report"]},{"url":"https://bugzilla.suse.com/1275096","tags":["report"]},{"url":"https://bugzilla.suse.com/1275594","tags":["report"]},{"url":"https://bugzilla.suse.com/1275732","tags":["report"]},{"url":"https://bugzilla.suse.com/1275859","tags":["report"]},{"url":"https://bugzilla.suse.com/1275860","tags":["report"]},{"url":"https://bugzilla.suse.com/1275915","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76957","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623912-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259712","tags":["report"]},{"url":"https://bugzilla.suse.com/1259727","tags":["report"]},{"url":"https://bugzilla.suse.com/1259730","tags":["report"]},{"url":"https://bugzilla.suse.com/1275098","tags":["report"]},{"url":"https://bugzilla.suse.com/1275605","tags":["report"]},{"url":"https://bugzilla.suse.com/1275736","tags":["report"]},{"url":"https://bugzilla.suse.com/1282347","tags":["report"]},{"url":"https://bugzilla.suse.com/1284493","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93990","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249584","tags":["report"]},{"url":"https://bugzilla.suse.com/1257144","tags":["report"]},{"url":"https://bugzilla.suse.com/1257496","tags":["report"]},{"url":"https://bugzilla.suse.com/1259711","tags":["report"]},{"url":"https://bugzilla.suse.com/1259726","tags":["report"]},{"url":"https://bugzilla.suse.com/1259729","tags":["report"]},{"url":"https://bugzilla.suse.com/1275115","tags":["report"]},{"url":"https://bugzilla.suse.com/1283493","tags":["report"]},{"url":"https://bugzilla.suse.com/1284334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77214","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624554-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264615-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264619-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264623-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275108","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110249","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264806-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264834-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56409","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8813-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56131","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56132","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56410","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56411","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66046","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-72522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-76641","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-76957","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56409","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T15:52:59.663Z","modified":"2026-06-22T15:56:24.103Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:37:02.780526Z"}],"euvd":[{"id":"EUVD-2026-38186","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T15:52:59Z","modified":"2026-06-22T15:56:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:34.745289Z"}],"ghsa":[{"id":"GHSA-jhv6-83wh-9vj5","title":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir...","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T18:32:21Z","modified":"2026-06-21T18:32:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:08:55.672723Z"}],"nvd":[{"id":"CVE-2026-56409","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T16:16:28.23Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-56409","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T16:16:28.23Z","modified":"2026-10-01T02:17:49.356795744Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-56409","status":"published","published":"2026-06-23T06:12:37.867636Z","modified":"2026-07-01T07:15:05.687523789Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56409","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T15:52:59.663Z","modified":"2026-11-07T17:27:11.602440589Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T17:50:08.495879Z"},{"id":"DEBIAN-CVE-2026-56409","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T16:16:28.23Z","modified":"2026-10-26T11:47:28.275823554Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"JLSEC-2026-1233","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-08-09T01:27:54.135Z","modified":"2026-08-09T01:30:05.500117532Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2973","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.924054393Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2974","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.994318857Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2975","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.985175693Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2976","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:17.180678155Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-56409","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T16:16:00Z","modified":"2026-10-17T13:00:28.212964547Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90249","title":"CVE-2026-56409 affecting package expat for versions less than 2.8.2-1","description":"xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.","status":"published","published":"2026-06-21T16:16:28Z","modified":"2026-08-28T17:56:37.726581Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"CLSA-2026-1786034306","title":"expat: Fix of 3 CVEs","description":"- CVE-2026-56407: cap entity textLen against signed integer overflow in doProlog\n- CVE-2026-56408: protect copyString from integer overflow\n- CVE-2026-56409: protect xmlwf output path join from integer overflow","status":"published","published":"2026-08-06T16:38:38Z","modified":"2026-10-26T09:31:25.195451896Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786451206","title":"Fix CVE(s): CVE-2026-56407, CVE-2026-56408, CVE-2026-56409","description":"   * SECURITY UPDATE: Integer overflow in doProlog related to\n     storeEntityValue and entity textLen (libexpat before 2.8.2)\n     - debian/patches/CVE-2026-56407.patch: cap the entity value pool\n       length at INT_MAX before assigning it to the signed\n       ENTITY::textLen in doProlog\n     - CVE-2026-56407\n   * SECURITY UPDATE: Integer overflow in copyString (libexpat before\n     2.8.2)\n     - debian/patches/CVE-2026-56408.patch: reject lengths above\n       SIZE_MAX / sizeof(XML_Char) before sizing the copy, closing the\n       multiplication overflow in wide-character (libexpatw) builds\n     - CVE-2026-56408\n   * SECURITY UPDATE: Integer overflow for the output filename in xmlwf\n     when -d outputDir is used (libexpat before 2.8.2)\n     - debian/patches/CVE-2026-56409.patch: check the output path join\n       for addition and multiplication overflow, and check the malloc\n       result, before writing the joined path\n     - CVE-2026-56409","status":"published","published":"2026-08-11T12:26:59Z","modified":"2026-10-26T09:31:52.831342916Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2026-0352","title":"Updated expat \u0026 mingw-expat packages fix security vulnerabilities","description":"Missing control flow integrity checks. (CVE-2026-50219)\nMissing control flow integrity checks. (CVE-2026-56131)\nOut-of-bounds write. (CVE-2026-56132)\nInteger overflow. (CVE-2026-56403)\nInteger overflow. (CVE-2026-56404)\nInteger overflow. (CVE-2026-56405)\nInteger overflow. (CVE-2026-56406)\nInteger overflow. (CVE-2026-56407)\nInteger overflow. (CVE-2026-56408)\nInteger overflow. (CVE-2026-56409)\nInteger overflow. (CVE-2026-56410)\nInteger overflow. (CVE-2026-56411)\nMissing control flow integrity checks. (CVE-2026-56412)\n","status":"published","published":"2026-08-31T19:40:26Z","modified":"2026-08-31T19:45:02.623431757Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11584-1","title":"expat-2.8.2-1.1 on GA media","description":"These are all security issues fixed in the expat-2.8.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-24T00:00:00Z","modified":"2026-08-26T18:23:38.131968799Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21945-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a\n  denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,\n  XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).\n- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer\n  overflows (bsc#1268573).\n- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code\n  execution (bsc#1275096).\n- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory\n  corruption, and application crashes (bsc#1275096).\n- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary\n  code execution (bsc#1275096).\n- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and\n  application crashes (bsc#1275096).\n- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial\n  of service (bsc#1275096).\n- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes\n  (bsc#1275096).\n- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and\n  arbitrary file write conditions (bsc#1275096).\n- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information\n  disclosure, and potential code execution (bsc#1275096).\n- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and\n  denial of service (bsc#1275096).\n- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free\n  conditions and arbitrary code execution (bsc#1275096).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the\n  storeAtts() function in xmlparse.c (bsc#1275732).\n- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to\n  insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via\n  crafted X (bsc#1275860).\n- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).\n\nChanges for expat:\n\n- Updated to version 2.8.4\n","status":"published","published":"2026-09-24T07:03:56Z","modified":"2026-09-25T18:23:14.327905672Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22139-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n\n- CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside\n  an entity declaration value. (bsc#1259727)\n- CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)\n- CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition. (bsc#1259730)\n- CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML document. (bsc#1262263)\n- CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of service via moderately\n  sized crafted XML input. (bsc#1264713)\n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to\n  information disclosure, integrity loss, or denial of service. (bsc#1275098)\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in\n  libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to\n  denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead\n  to memory corruption. (bsc#1275098)\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption\n  and potential security risks. (bsc#1275098)\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of\n  service or memory corruption. (bsc#1275098)\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function\n  in xmlparse.c. (bsc#1275736)\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed\n  attackers to cause denial of service. (bsc#1275605)\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger\n  memory corruption or a crash. (bsc#1275736)\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers\n  to cause a denial of service via hash flooding attacks. (bsc#1275736)\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in\n  libexpat could lead to memory corruption. (bsc#1275736)\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired\n  surrogates or silently replace input characters. (bsc#1282347)\n","status":"published","published":"2026-10-19T14:43:34Z","modified":"2026-10-22T17:23:12.292232274Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-56409","title":"CVE-2026-56409 in expat - Patched by Root","description":"Root has patched CVE-2026-56409 in the expat package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-19T10:19:12Z","modified":"2026-10-19T11:15:04.975790531Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-56409","title":"CVE-2026-56409 in expat - Patched by Root","description":"Root has patched CVE-2026-56409 in the expat package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T11:47:59Z","modified":"2026-09-07T14:00:04.17470266Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-56409","title":"CVE-2026-56409 in expat - Patched by Root","description":"Root has patched CVE-2026-56409 in the expat package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T11:50:58Z","modified":"2026-09-15T14:00:06.671407194Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23894-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a\n  denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,\n  XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).\n- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer\n  overflows (bsc#1268573).\n- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code\n  execution (bsc#1275096).\n- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory\n  corruption, and application crashes (bsc#1275096).\n- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary\n  code execution (bsc#1275096).\n- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and\n  application crashes (bsc#1275096).\n- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial\n  of service (bsc#1275096).\n- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes\n  (bsc#1275096).\n- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and\n  arbitrary file write conditions (bsc#1275096).\n- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information\n  disclosure, and potential code execution (bsc#1275096).\n- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and\n  denial of service (bsc#1275096).\n- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free\n  conditions and arbitrary code execution (bsc#1275096).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the\n  storeAtts() function in xmlparse.c (bsc#1275732).\n- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to\n  insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via\n  crafted X (bsc#1275860).\n- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).\n\nChanges for expat:\n\n- Updated to version 2.8.4\n","status":"published","published":"2026-09-24T07:07:13Z","modified":"2026-09-30T18:23:11.313620448Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23912-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a\n  denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,\n  XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).\n- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer\n  overflows (bsc#1268573).\n- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code\n  execution (bsc#1275096).\n- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory\n  corruption, and application crashes (bsc#1275096).\n- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary\n  code execution (bsc#1275096).\n- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and\n  application crashes (bsc#1275096).\n- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial\n  of service (bsc#1275096).\n- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes\n  (bsc#1275096).\n- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and\n  arbitrary file write conditions (bsc#1275096).\n- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information\n  disclosure, and potential code execution (bsc#1275096).\n- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and\n  denial of service (bsc#1275096).\n- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free\n  conditions and arbitrary code execution (bsc#1275096).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the\n  storeAtts() function in xmlparse.c (bsc#1275732).\n- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to\n  insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via\n  crafted X (bsc#1275860).\n- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).\n\nChanges for expat:\n\n- Updated to version 2.8.4\n","status":"published","published":"2026-09-24T07:07:13Z","modified":"2026-09-30T18:23:12.534238624Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24260-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n\n- CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside\n  an entity declaration value. (bsc#1259727)\n- CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)\n- CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition. (bsc#1259730)\n- CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML document. (bsc#1262263)\n- CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of service via moderately\n  sized crafted XML input. (bsc#1264713)\n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to\n  information disclosure, integrity loss, or denial of service. (bsc#1275098)\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in\n  libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to\n  denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead\n  to memory corruption. (bsc#1275098)\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption\n  and potential security risks. (bsc#1275098)\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of\n  service or memory corruption. (bsc#1275098)\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function\n  in xmlparse.c. (bsc#1275736)\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed\n  attackers to cause denial of service. (bsc#1275605)\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger\n  memory corruption or a crash. (bsc#1275736)\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers\n  to cause a denial of service via hash flooding attacks. (bsc#1275736)\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in\n  libexpat could lead to memory corruption. (bsc#1275736)\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired\n  surrogates or silently replace input characters. (bsc#1282347)\n","status":"published","published":"2026-10-19T15:16:56Z","modified":"2026-10-23T17:23:10.652324282Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24323-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-17T13:49:25Z","modified":"2026-10-27T17:23:13.622800769Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24554-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-27T14:41:39Z","modified":"2026-11-07T17:23:17.381879846Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"SUSE-SU-2026:4615-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:20:23Z","modified":"2026-10-13T10:30:04.873577795Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4619-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix a class of false positives where input should have been\n   rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n   earlier security fix (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n   and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n   dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-19T08:29:07Z","modified":"2026-10-19T09:43:18.179140646Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4623-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:27:49Z","modified":"2026-10-13T10:30:05.847197418Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4736-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n- CVE-2026-110249: Denial-of-service in the Exchange email component.\n\nlibexpat updated:\n \n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service (bsc#1275108).\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks (bsc#1275108).\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#1275736).\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service (bsc#1275605).\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash (bsc#1275736).\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks (bsc#1275736).\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption (bsc#1275736).\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters (bsc#1282347).\n","status":"published","published":"2026-10-19T12:57:04Z","modified":"2026-10-20T10:45:04.190986882Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4806-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n  \n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n    \n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service (bsc#1275098).\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service (bsc#1275098).\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption (bsc#1275098).\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption (bsc#1275098).\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks (bsc#1275098).\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption (bsc#1275098).\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service (bsc#1275098).\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption (bsc#1275098).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#1275736).\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service (bsc#1275605).\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash (bsc#1275736).\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks (bsc#1275736).\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption (bsc#1275736).\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters (bsc#1282347).\n","status":"published","published":"2026-10-21T08:01:36Z","modified":"2026-10-21T20:02:16.0687972Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4834-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n    \n- CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value. (bsc#1259727)\n- CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)\n- CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition. (bsc#1259730)\n- CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML document. (bsc#1262263)\n- CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. (bsc#1264713)\n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service. (bsc#1275098)\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks. (bsc#1275098)\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c. (bsc#1275736)\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service. (bsc#1275605)\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash. (bsc#1275736)\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks. (bsc#1275736)\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption. (bsc#1275736)\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters. (bsc#1282347)\n","status":"published","published":"2026-10-21T12:51:17Z","modified":"2026-10-22T11:45:03.861208944Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8813-1","title":"expat vulnerabilities","description":"It was discovered that Expat did not correctly handle certain integer\narithmetic. An attacker could possibly use this issue to cause a denial of\nservice. \n(CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)\n\nIt was discovered that Expat did not correctly track handler call depth. An\nattacker could possibly use this issue to cause Expat to crash or execute\narbitrary code. (CVE-2026-56131)\n\nIt was discovered that Expat did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause Expat to\ncrash or execute arbitrary code. (CVE-2026-56132)\n\nIt was discovered that Expat did not correctly handle certain Unicode\ncharacters. An attacker could possibly use this issue to cause Expat to use\nexcessive resources, leading to a denial of service. (CVE-2026-72522)\n\nIt was discovered that Expat did not correctly process certain XML\nattributes. A remote attacker could possibly use this issue to cause Expat\nto use excessive resources, leading to a denial of service.\n(CVE-2026-66046)\n\nIt was discovered that Expat did not correctly handle certain external\nentities. An attacker could possibly use this issue to cause Expat to crash\nor execute arbitrary code. (CVE-2026-76641)\n\nIt was discovered that Expat did not correctly track handler call depth\nwith custom encodings. An attacker could possibly use this issue to cause\nExpat to crash or execute arbitrary code. (CVE-2026-76957)","status":"published","published":"2026-09-24T12:45:19Z","modified":"2026-09-25T00:43:11.198618689Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}