CVE-2026-77214
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, leading to out-of-bounds reads and disclosure of adjacent heap memory, including heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR.
Risk Assessment
An attacker could exploit the vulnerability to disclose sensitive memory information, potentially facilitating further attacks and bypassing security mechanisms. This may compromise system confidentiality and integrity.
Recommendation
Update libexpat to a version containing commit 13c5f63 or later. Until then, avoid processing untrusted XML data with the vulnerable library.
Other vulnerabilities in libexpat
See all- CVE-2026-113351Medium
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
- CVE-2026-102633Medium
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in the expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
- CVE-2024-45490High
An issue was discovered in libexpat before 2.6.3, where xmlparse.c does not reject a negative length for XML_ParseBuffer.
- CVE-2017-11742High
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat versions 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory due to an untrusted search path, known as DLL hijacking.
- CVE-2024-45492Critical
An issue was discovered in libexpat before version 2.6.3, which can lead to an integer overflow in the nextScaffoldPart function in xmlparse.c on 32-bit platforms.
- CVE-2024-45491Critical
An issue was discovered in libexpat before version 2.6.3 related to integer overflow in the dtdCopy function in xmlparse.c. This issue occurs on 32-bit platforms where UINT_MAX equals SIZE_MAX.
- CVE-2019-15903High
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
- CVE-2017-9233High
XML External Entity vulnerability in libexpat 2.2.0 and earlier allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
- CVE-2026-118370Medium
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- CVE-2026-117610Medium
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
Original NVD description (English source)
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS