Skip to content
Libexpat Project vulnerabilities
Newest
-
libexpat
libexpat through 2.10.0 Out-of-Bounds Read via unknown_toUtf8 and unknown_toUtf16
CVE-2026-124317
6.3 Medium
-
libexpat
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
CVE-2026-118370
Fix available
8.2 High
-
libexpat
libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
CVE-2026-117610
Fix available
8.2 High
-
libexpat
libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
CVE-2026-115506
Fix available
8.7 High
-
libexpat
libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
CVE-2026-113351
Fix available
8.2 High
-
libexpat
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
CVE-2026-77214
Fix available
8.3 High
-
libexpat
libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
CVE-2026-102633
Fix available
8.2 High
-
libexpat
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
CVE-2026-93990
Fix available
8.7 High
-
libexpat
Expat Out-of-Bounds Read via dtdCopy
CVE-2026-76641
Fix available
8.7 High
-
libexpat project libexpat
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a...
CVE-2026-76957
Fix available
4.9 Medium
-
libexpat project libexpat
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to...
CVE-2026-76956
Fix available
5.9 Medium
-
libexpat project libexpat
Expat Denial of Service via storeAtts() Quadratic Complexity
CVE-2026-66046
Fix available
8.7 High
-
libexpat project libexpat
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low...
CVE-2026-72522
Fix available
6.2 Medium
-
libexpat project libexpat
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks...
CVE-2026-56412
Fix available
4.9 Medium
-
libexpat project libexpat
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56411
Fix available
6.9 Medium
-
libexpat project libexpat
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56410
Fix available
6.9 Medium
-
libexpat project libexpat
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir...
CVE-2026-56409
Fix available
6.5 Medium
-
libexpat project libexpat
libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56408
Fix available
6.9 Medium
-
libexpat project libexpat
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and...
CVE-2026-56407
Fix available
6.9 Medium
-
libexpat project libexpat
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that...
CVE-2026-56406
Fix available
6.9 Medium
-
libexpat project libexpat
libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56405
Fix available
6.9 Medium
-
libexpat project libexpat
libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56404
Fix available
6.9 Medium
-
libexpat project libexpat
libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56403
Fix available
6.9 Medium
-
libexpat project libexpat
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because...
CVE-2026-56132
Fix available
6.9 Medium
-
libexpat project libexpat
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within...
CVE-2026-56131
Fix available
4.9 Medium
-
libexpat project libexpat
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,...
CVE-2026-50219
Fix available
4.9 Medium
-
libexpat project libexpat, red hat discovery 2, enterprise linux 10 +9 more +11 more
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows...
CVE-2026-45186
Fix available
2.9 Low
-
libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more
libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted...
CVE-2026-41080
Fix available
2.9 Low
-
libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after...
CVE-2026-32778
Fix available
2.9 Low
-
libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32777
Fix available
4.0 Medium
-
libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity...
CVE-2026-32776
Fix available
4.0 Medium
-
libexpat project libexpat, siemens ruggedcom rst2428p +1 more
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size...
CVE-2026-25210
Fix available
6.9 Medium
-
libexpat project libexpat, siemens ruggedcom rst2428p +1 more
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler...
CVE-2026-24515
Fix available
2.9 Low
-
libexpat project libexpat, siemens ruggedcom rst2428p, simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of...
CVE-2025-66382
Fix available
2.9 Low
-
libexpat project libexpat, siemens ruggedcom rst2428p, scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family +17 more +19 more
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a...
CVE-2025-59375
Fix available
7.5 High