{"id":"CVE-2026-77214","aliases":["ALPINE-CVE-2026-77214","ALSA-2026:88247","ALSA-2026:88248","ALSA-2026:89758","ALSA-2026:92323","AZL-106728","AZL-107228","BELL-CVE-2026-77214","CLSA-2026-1792993465","DEBIAN-CVE-2026-77214","EUVD-2026-94368","GHSA-8xfx-9m5m-pgcp","OESA-2026-4348","OESA-2026-4349","OESA-2026-4350","OESA-2026-4351","RHSA-2026:77959","RLSA-2026:88247","RLSA-2026:88248","RLSA-2026:89758","RLSA-2026:92323","ROOT-OS-DEBIAN-12-CVE-2026-77214","ROOT-OS-DEBIAN-13-CVE-2026-77214","SUSE-SU-2026:24323-1","SUSE-SU-2026:24460-1","SUSE-SU-2026:24469-1","SUSE-SU-2026:24554-1","SUSE-SU-2026:4615-1","SUSE-SU-2026:4619-1","SUSE-SU-2026:4623-1","UBUNTU-CVE-2026-77214","openSUSE-SU-2026:12100-1","openSUSE-SU-2026:22177-1"],"status":"published","title":"libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0033,"percentile":0.2651,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-10-07T06:07:05.160933Z","modified":"2026-11-11T02:49:06Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.9.0-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.9.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"expat","fixed_in":["2.0.1-13.el6_8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","fixed_in":["2.0.1-13.el6_8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.9.0-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.9.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","fixed_in":["2.4.1-33.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"expat","fixed_in":["2.5.0-29.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"expat","fixed_in":["2.5.0-29.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"expat","fixed_in":["2.8.1-10.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"expat","fixed_in":["0:2.8.5-1.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"expat-devel","fixed_in":["0:2.8.5-1.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"expat-static","fixed_in":["0:2.8.5-1.2.hum1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"expat","fixed_in":["2.9.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-6.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-6.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.3-1.el10_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-1.el10_2"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"cmake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.30.3-15"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.9.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u5"}]}],"versions":["2.5.0-1","2.5.0-1+deb12u1","2.5.0-1+deb12u2","2.5.0-1+deb12u3","2.5.0-1+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1~deb13u1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1","2.8.2-1","2.8.2-1~deb13u1","2.8.3-1","2.8.3-1~deb13u1","2.8.4-1","2.8.4-2","2.8.5-1","2.8.5-2"]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1","2.8.2-1","2.8.2-1~deb13u1","2.8.3-1","2.8.3-1~deb13u1","2.8.4-1","2.8.4-2","2.8.5-1","2.8.5-2","2.9.0-1~deb13u1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-33.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-29.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-29.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-10.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-1.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-1.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-1.2.hum1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-6.el9_8.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.3-1.el10_2.7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.5.0-1.el10_2"}]}],"bundled":29},{"source":"osv","ecosystem":"Rocky Linux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-6.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-159998.1.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-slfo.1.1_1.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150700.3.15.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9","2.1.0-4ubuntu1.4+esm10","2.1.0-4ubuntu1.4+esm11","2.1.0-4ubuntu1.4+esm12","2.1.0-4ubuntu1.4+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9","2.1.0-7ubuntu0.16.04.5+esm10","2.1.0-7ubuntu0.16.04.5+esm11","2.1.0-7ubuntu0.16.04.5+esm12","2.1.0-7ubuntu0.16.04.5+esm13","2.1.0-7ubuntu0.16.04.5+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4","2.4.4-4build1","2.4.4-4ubuntu1","2.6.1-3","2.6.2-1","2.6.2-2","2.6.2-3","2.6.3-1","2.6.3-1ubuntu1","2.6.3-2ubuntu1","2.6.3-3ubuntu1","2.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.1~esm1","1.2-3ubuntu0.16.04.1~esm1","1.2-3ubuntu0.16.04.1~esm2","1.2-3ubuntu0.16.04.1~esm3","1.2-3ubuntu0.16.04.1~esm4","1.2-3ubuntu0.16.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1","2.2.5-3ubuntu0.9+esm2","2.2.5-3ubuntu0.9+esm3","2.2.5-3ubuntu0.9+esm4","2.2.5-3ubuntu0.9+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-3build1","2.8.3-1","2.8.4-1","2.8.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2","1.2-4ubuntu0.18.04.1~esm3","1.2-4ubuntu0.18.04.1~esm4","1.2-4ubuntu0.18.04.1~esm5","1.2-4ubuntu0.18.04.1~esm6","1.2-4ubuntu0.18.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7","2.2.9-1ubuntu0.8","2.2.9-1ubuntu0.8+esm1","2.2.9-1ubuntu0.8+esm2","2.2.9-1ubuntu0.8+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2","1.2-4ubuntu0.20.04.1~esm3","1.2-4ubuntu0.20.04.1~esm4","1.2-4ubuntu0.20.04.1~esm5","1.2-4ubuntu0.20.04.1~esm6","1.2-4ubuntu0.20.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4","2.4.7-1ubuntu0.5","2.4.7-1ubuntu0.6","2.4.7-1ubuntu0.7","2.4.7-1ubuntu0.8","2.4.7-1ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.22.04.1~esm1","1.2-4ubuntu0.22.04.1~esm2","1.2-4ubuntu0.22.04.1~esm3","1.2-4ubuntu0.22.04.1~esm4","1.2-4ubuntu0.22.04.1~esm5","1.2-4ubuntu0.22.04.1~esm6","1.2-4ubuntu0.22.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1","2.6.1-2ubuntu0.2","2.6.1-2ubuntu0.3","2.6.1-2ubuntu0.4","2.6.1-2ubuntu0.5","2.6.1-2ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2","1.2-4.1ubuntu2.24.0.4.1+esm1","1.2-4.1ubuntu2.24.0.4.1+esm2","1.2-4.1ubuntu2.24.0.4.1+esm3","1.2-4.1ubuntu2.24.0.4.1+esm4","1.2-4.1ubuntu2.24.0.4.1+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.4-1","2.8.1-1","2.8.2-1","2.8.3-1","2.8.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-2","2.7.3-1","2.7.4-1","2.7.4-1ubuntu0.1","2.7.4-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"libexpat","product":"libexpat"},{"vendor":"libexpat project","product":"libexpat"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/1393","tags":["issue-tracking","patch","fix","article","report"]},{"url":"https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0","tags":["patch","fix","article"]},{"url":"https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer","tags":["third-party-advisory","advisory","article"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77214","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8xfx-9m5m-pgcp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-77214","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:88247","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-102633","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-77214","tags":["report"]},{"url":"https://bugzilla.redhat.com/2543288","tags":["report"]},{"url":"https://bugzilla.redhat.com/2547476","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-88247.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:88248","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-88248.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89758","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109704","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109705","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109706","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109707","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109708","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109709","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109711","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109712","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109713","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109715","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109716","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109717","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109718","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109719","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109720","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109721","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109722","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109723","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109724","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109725","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109726","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109727","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109728","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109729","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109730","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109732","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109740","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45186","tags":["report"]},{"url":"https://bugzilla.redhat.com/2468575","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550397","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550404","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550405","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550413","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550420","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550424","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550433","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550438","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550446","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550451","tags":["report"]},{"url":"https://bugzilla.redhat.com/2550455","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-89758.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92323","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92323.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-77214","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1792993465.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77214.json","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77214","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4348","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4349","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4350","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4351","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:77959","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77959.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547476","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77214","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:88247","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543288","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:88248","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89758","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550413","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550438","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550478","tags":["report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92323","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249584","tags":["report"]},{"url":"https://bugzilla.suse.com/1257144","tags":["report"]},{"url":"https://bugzilla.suse.com/1257496","tags":["report"]},{"url":"https://bugzilla.suse.com/1259711","tags":["report"]},{"url":"https://bugzilla.suse.com/1259726","tags":["report"]},{"url":"https://bugzilla.suse.com/1259729","tags":["report"]},{"url":"https://bugzilla.suse.com/1262263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264713","tags":["report"]},{"url":"https://bugzilla.suse.com/1267631","tags":["report"]},{"url":"https://bugzilla.suse.com/1268572","tags":["report"]},{"url":"https://bugzilla.suse.com/1268573","tags":["report"]},{"url":"https://bugzilla.suse.com/1275115","tags":["report"]},{"url":"https://bugzilla.suse.com/1275594","tags":["report"]},{"url":"https://bugzilla.suse.com/1275732","tags":["report"]},{"url":"https://bugzilla.suse.com/1275859","tags":["report"]},{"url":"https://bugzilla.suse.com/1275860","tags":["report"]},{"url":"https://bugzilla.suse.com/1275915","tags":["report"]},{"url":"https://bugzilla.suse.com/1282347","tags":["report"]},{"url":"https://bugzilla.suse.com/1283493","tags":["report"]},{"url":"https://bugzilla.suse.com/1284334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93990","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624460-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624469-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624554-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264615-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264619-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264623-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-77214","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-77214","title":"libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T14:35:42.794Z","modified":"2026-11-10T12:49:48.816Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-10T13:38:45.30478Z"}],"euvd":[{"id":"EUVD-2026-94368","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T14:35:42Z","modified":"2026-11-10T12:49:48Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-08T15:13:06.469155Z"}],"ghsa":[{"id":"GHSA-8xfx-9m5m-pgcp","title":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c....","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T15:32:01Z","modified":"2026-11-10T15:32:59Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-10T15:55:01.855926Z"}],"nvd":[{"id":"CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T15:17:53.327Z","modified":"2026-11-10T13:19:39.863Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-10T16:19:48.451664Z"}],"osv":[{"id":"ALPINE-CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T15:17:53.327Z","modified":"2026-10-18T10:30:02.730799092Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-77214","status":"published","published":"2026-10-07T06:07:05.160933Z","modified":"2026-10-17T07:15:05.104673901Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:28:26.041478Z"},{"id":"CVE-2026-77214","title":"libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T14:35:42.794Z","modified":"2026-11-11T02:49:06.251830299Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-11T03:21:18.82478Z"},{"id":"DEBIAN-CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T15:17:53.327Z","modified":"2026-11-11T09:47:38.260597625Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-11T10:35:40.696585Z"},{"id":"OESA-2026-4348","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u0026gt;m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)","status":"published","published":"2026-10-16T11:59:37Z","modified":"2026-10-16T12:15:10.787225243Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4349","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u0026gt;m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)","status":"published","published":"2026-10-16T11:59:38Z","modified":"2026-10-16T12:15:19.070214532Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4350","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u0026gt;m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)","status":"published","published":"2026-10-16T11:59:39Z","modified":"2026-10-16T12:15:13.600770809Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4351","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u0026gt;m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.(CVE-2026-77214)","status":"published","published":"2026-10-16T11:59:39Z","modified":"2026-10-16T12:15:19.973608904Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:77959","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-10T10:22:28Z","modified":"2026-10-17T10:20:23Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:88247","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)\n\n* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-23T06:45:29.064378Z","modified":"2026-10-23T07:15:02.482471139Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:88248","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)\n\n* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-23T12:11:02.998013Z","modified":"2026-10-23T12:45:02.520962926Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89758","title":"Important: firefox security, bug fix, and enhancement update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libexpat: denial of service via crafted XML input (CVE-2026-45186)\n\n* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n\n* firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)\n\n* firefox: Use-after-free in the XML component (CVE-2026-109718)\n\n* firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)\n\n* firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)\n\n* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)\n\n* firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)\n\n* firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109724)\n\n* firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)\n\n* firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)\n\n* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)\n\n* firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)\n\n* firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)\n\n* firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)\n\n* firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)\n\n* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)\n\n* firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)\n\n* firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)\n\n* firefox: Use-after-free in the SVG component (CVE-2026-109726)\n\n* firefox: Integer overflow in the Graphics component (CVE-2026-109730)\n\n* firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)\n\n* firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)\n\n* firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109725)\n\n* firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)\n\n* firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)\n\n* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)\n\n* firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)\n\n* firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)\n\nBug Fix(es) and Enhancement(s):\n\n* Firefox ESR 153 rebase [rhel-10.2.z] (JIRA:Rocky Linux-175166)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-31T12:09:44.748638Z","modified":"2026-10-31T12:30:02.5217581Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92323","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)\n\n* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:01:09.65921Z","modified":"2026-10-30T12:30:03.140595817Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-77214","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T15:17:00Z","modified":"2026-10-17T13:01:08.485362017Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","level":"high"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"ALSA-2026:88247","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.  \n\nSecurity Fix(es):  \n\n  * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)\n  * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-22T00:00:00Z","modified":"2026-10-29T11:32:38.765838551Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:88248","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.  \n\nSecurity Fix(es):  \n\n  * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)\n  * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-22T00:00:00Z","modified":"2026-10-29T11:31:02.636421545Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89758","title":"Important: firefox security, bug fix, and enhancement update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * libexpat: denial of service via crafted XML input (CVE-2026-45186)\n  * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n  * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)\n  * firefox: Use-after-free in the XML component (CVE-2026-109718)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)\n  * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)\n  * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)\n  * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109724)\n  * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)\n  * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)\n  * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)\n  * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)\n  * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)\n  * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)\n  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)\n  * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)\n  * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)\n  * firefox: Use-after-free in the SVG component (CVE-2026-109726)\n  * firefox: Integer overflow in the Graphics component (CVE-2026-109730)\n  * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)\n  * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109725)\n  * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)\n  * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)\n  * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)\n  * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Firefox ESR 153 rebase [rhel-10.2.z] (JIRA:RHEL-175166)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-11-04T16:45:02.619158975Z","updated_at":"2026-11-04T17:11:08.071099Z"},{"id":"ALSA-2026:92323","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.  \n\nSecurity Fix(es):  \n\n  * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633)\n  * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T11:01:03.118169868Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-106728","title":"CVE-2026-77214 affecting package expat for versions less than 2.9.0-1","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T15:17:53Z","modified":"2026-11-02T14:16:22.208025106Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-107228","title":"CVE-2026-77214 affecting package cmake 3.30.3-15","description":"libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.","status":"published","published":"2026-10-07T15:17:53Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"CLSA-2026-1792993465","title":"expat: Fix of CVE-2026-77214","description":"- CVE-2026-77214: reject XML_ParseBuffer lengths larger than the space left in the internal buffer","status":"published","published":"2026-10-26T05:44:36Z","modified":"2026-10-26T09:31:54.456483735Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12100-1","title":"expat-2.9.0-1.1 on GA media","description":"These are all security issues fixed in the expat-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.857670257Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22177-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","status":"published","published":"2026-10-27T16:07:43Z","modified":"2026-11-01T17:23:29.413374471Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-77214","title":"CVE-2026-77214 in expat - Patched by Root","description":"Root has patched CVE-2026-77214 in the expat package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-10-19T09:09:46Z","modified":"2026-10-23T13:00:05.190257186Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-77214","title":"CVE-2026-77214 in expat - Patched by Root","description":"Root has patched CVE-2026-77214 in the expat package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-10-15T06:49:48Z","modified":"2026-10-19T13:00:05.105253635Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:24323-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-17T13:49:25Z","modified":"2026-10-27T17:23:13.622800769Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24460-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","status":"published","published":"2026-10-27T16:12:58Z","modified":"2026-11-02T17:23:09.756312758Z","updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"SUSE-SU-2026:24469-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","status":"published","published":"2026-10-27T16:12:58Z","modified":"2026-11-04T17:23:18.513414738Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:24554-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-27T14:41:39Z","modified":"2026-11-07T17:23:17.381879846Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"SUSE-SU-2026:4615-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:20:23Z","modified":"2026-10-13T10:30:04.873577795Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4619-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix a class of false positives where input should have been\n   rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n   earlier security fix (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n   and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n   dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-19T08:29:07Z","modified":"2026-10-19T09:43:18.179140646Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4623-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:27:49Z","modified":"2026-10-13T10:30:05.847197418Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}