Expat vulnerabilities

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

In Expat (libexpat) before 2.4.5, there is an integer overflow in copyString.

In xmlparse.c in Expat (aka libexpat) before 2.4.5, attackers can insert namespace-separator characters into namespace URIs.

In xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Expat (libexpat) before 2.4.4 has an integer overflow in the doProlog function. This may lead to improper XML parser behavior.

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

The defineAttribute function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.

The build_model function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

In Expat (libexpat) before 2.4.3, a left shift by 29 or more bits in the storeAtts function in xmlparse.c can lead to realloc misbehavior, such as allocating too few bytes or only freeing memory.

In libexpat (Expat before 2.2.7), XML input including XML names with a large number of colons could make the parser consume high amounts of RAM and CPU resources, enough for denial-of-service attacks.

The overflow protection in Expat is removed by compilers with certain optimization settings, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function. This allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.

The updatePosition function in libexpat (Expat 2.0.1) has a buffer over-read vulnerability. Crafted UTF-8 sequences in an XML document can cause an application crash.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Denial of service vulnerability in Expat through 2.8.3. The storeAtts() function in xmlparse.c has quadratic complexity, causing excessive CPU consumption when processing an XML document with many attributes with non-normalized values.

In Expat (also known as libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

In Expat (libexpat) before 2.4.3, the storeAtts function in xmlparse.c has an integer overflow. This may lead to incorrect parser behavior when processing specially crafted XML documents.

In Expat (libexpat) before 2.4.3, the nextScaffoldPart function in xmlparse.c has an integer overflow. This may lead to incorrect parser behavior when processing specially crafted XML documents.

In Expat (libexpat) before 2.4.3, the lookup function in xmlparse.c has an integer overflow. This may lead to incorrect parser behavior when processing specially crafted XML documents.

In doProlog in xmlparse.c in Expat (libexpat) before 2.4.3, an integer overflow exists for m_groupSize. This may lead to improper XML parser behavior.