libexpat project libexpat
26 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-76957 | < 2.8.4 | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is simi | HIGH 7.8 | 0.1 % | ||
| CVE-2026-76956 | 2.8.2 – < 2.8.4 | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in bein | HIGH 7.5 | 0.3 % | ||
| CVE-2026-66046 | ≤ 2.8.3 | Expat Denial of Service via storeAtts() Quadratic Complexity | HIGH 8.7 | 0.7 % | ||
| CVE-2026-72522 | < 2.8.3 | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates d | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-56412 | < 2.8.2 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls fr | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-56411 | < 2.8.2 | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-56410 | < 2.8.2 | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-56409 | < 2.8.2 | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-56408 | < 2.8.2 | libexpat before 2.8.2 has an integer overflow in copyString. | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-56407 | < 2.8.2 | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-56406 | < 2.8.2 | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-56405 | < 2.8.2 | libexpat before 2.8.2 has an integer overflow in getAttributeId. | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-56404 | < 2.8.2 | libexpat before 2.8.2 has an integer overflow in addBinding. | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-56403 | < 2.8.2 | libexpat before 2.8.2 has an integer overflow in storeAtts. | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-56132 | < 2.8.2 | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mis | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-56131 | < 2.8.2 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. T | MEDIUM 4.9 | 0.2 % | ||
| CVE-2026-50219 | < 2.8.2 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_Parse | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-45186 | < 2.8.1 | In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized cr | HIGH 7.5 | 0.5 % | ||
| CVE-2026-41080 | < 2.8.0 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | HIGH 7.5 | 0.4 % | ||
| CVE-2026-32778 | < 2.7.5 | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-32777 | < 2.7.5 | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-32776 | < 2.7.5 | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-25210 | < 2.7.4 | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow ch | HIGH 7.8 | 0.2 % | ||
| CVE-2026-24515 | < 2.7.4 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. | LOW 2.9 | 0.2 % | ||
| CVE-2025-66382 | ≤ 2.7.5 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-59375 | < 2.7.2 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsi | HIGH 7.5 | 1.4 % |