libexpat vulnerabilities

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in the expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

An issue was discovered in libexpat before 2.6.3, where xmlparse.c does not reject a negative length for XML_ParseBuffer.

The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat versions 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory due to an untrusted search path, known as DLL hijacking.

An issue was discovered in libexpat before version 2.6.3, which can lead to an integer overflow in the nextScaffoldPart function in xmlparse.c on 32-bit platforms.

An issue was discovered in libexpat before version 2.6.3 related to integer overflow in the dtdCopy function in xmlparse.c. This issue occurs on 32-bit platforms where UINT_MAX equals SIZE_MAX.

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

XML External Entity vulnerability in libexpat 2.2.0 and earlier allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, leading to out-of-bounds reads and disclosure of adjacent heap memory, including heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR.

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

In libexpat versions 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, making it vulnerable to hash flooding attacks, causing denial of service via crafted XML content.

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

In libexpat before version 2.8.2, XML_TOK_DATA_CHARS is not considered in doCdataSection, leading to a lack of handler call depth tracking in cases of policy violation. This can result in a use-after-free error.

In libexpat before version 2.8.2, there is an integer overflow in the xmlwf function that can occur when processing NOTATION declarations in endDoctypeDecl.

In libexpat before version 2.8.2, there is an integer overflow in the resolveSystemId function, which may lead to unexpected application behavior.

In libexpat before version 2.8.2, there is an integer overflow for the output filename when the -d outputDir option is used.

libexpat before version 2.8.2 has an integer overflow in the copyString function.

In libexpat before version 2.8.2, there is an integer overflow in the doProlog function related to storeEntityValue and entity textLen.

In libexpat before version 2.8.2, there is an integer overflow in XML_ParseBuffer due to a lack of a check that was present in XML_Parse.

libexpat before version 2.8.2 has an integer overflow in the getAttributeId function.

libexpat before 2.8.2 has an integer overflow in addBinding.

libexpat before 2.8.2 has an integer overflow in storeAtts.

In libexpat before version 2.8.2, there is a heap-based buffer overflow in the doProlog function in xmlparse.c. This issue arises from mishandling of scaffold backing array reallocation when there is data-structure sharing across parsers.

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. This can lead to a use-after-free situation.

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur.

In libexpat before version 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

The vulnerability in libexpat before version 2.8.0 is due to insufficient entropy, allowing a hash flooding attack via a crafted XML document.

In libexpat before version 2.7.5, a NULL pointer dereference occurs in the setContext function on retry after a previous out-of-memory condition.

The libexpat library before version 2.7.5 contains a vulnerability that causes an infinite loop while parsing DTD content. An attacker can provide specially crafted input, leading to application hang.

In libexpat before version 2.7.5, a NULL pointer dereference vulnerability exists when processing empty external parameter entity content. This can cause a crash in applications using this library.

A stack overflow vulnerability exists in the libexpat library due to unbounded recursion when handling nested entity references in XML documents. An attacker can craft a malicious XML file that exhausts stack space, causing a crash.

Issue in libexpat before version 2.6.4. The XML_ResumeParser function can crash if XML_StopParser stops/suspends an unstarted parser.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required when a large token needs multiple buffer fills.

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.