CVE Catalog
CVE-2026-32778
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
In libexpat before version 2.7.5, a NULL pointer dereference occurs in the setContext function on retry after a previous out-of-memory condition.
Risk Assessment
An attacker can exploit this vulnerability to crash applications using libexpat, leading to a denial of service (DoS).
Recommendation
Immediately update libexpat to version 2.7.5 or later.
Original NVD description (English source)
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.