CVE-2026-24515
published 2026-01-23CVE-2026-24515: In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
PriorityP410low2.5CVSS 3.1
AVLACHPRLUINSUCNINAL
EPSS
0.17%
6.6th percentile
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | expat | < expat 2.7.3-2 (forky) | expat 2.7.3-2 (forky) |
| libexpat_project | libexpat | < 2.7.4 | 2.7.4 |
CVSS provenance
nvdv3.12.5LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian2.9LOW
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Expat vulnerabilities
vendor_ubuntu·2026-02-16·CVSS 2.9
CVE-2026-24515 [LOW] Expat vulnerabilities
Title: Expat vulnerabilities
Summary: Several security issues were fixed in Expat.
USN-8022-1 fixed vulnerabilities in Expat. This update provides the
corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that Expat incorrectly handled the initialization of parsers
for external entities. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-24515)
It was discovered that Expat incorrectly handled integer calculations when
allocating memory for XML tags. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2026-25210)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
xmltok library vulnerabilities
vendor_ubuntu·2026-02-11·CVSS 2.9
CVE-2026-24515 [LOW] xmltok library vulnerabilities
Title: xmltok library vulnerabilities
Summary: Several security issues were fixed in the xmltok library.
It was discovered that Expat, contained within the xmltok library, incorrectly
handled the initialization of parsers for external entities. An attacker could
possibly use this issue to cause a denial of service. (CVE-2026-24515)
It was discovered that Expat, contained within the xmltok library, incorrectly
handled integer calculations when allocating memory for XML tags. An attacker
could possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-25210)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Expat vulnerabilities
vendor_ubuntu·2026-02-10·CVSS 7.5
CVE-2026-24515 [HIGH] Expat vulnerabilities
Title: Expat vulnerabilities
Summary: Several security issues were fixed in Expat.
It was discovered that Expat incorrectly handled memory when parsing certain
XML files. An attacker could possibly use this issue to cause a denial of
service. This issue was only addressed in Ubuntu 25.10. (CVE-2025-59375)
It was discovered that Expat incorrectly handled the initialization of parsers
for external entities. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-24515)
It was discovered that Expat incorrectly handled integer calculations when
allocating memory for XML tags. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2026-25210)
Instructions: In general, a standard system update will make all the necess
Red Hat
libexpat: libexpat null pointer dereference
vendor_redhat·2026-01-23·CVSS 2.9
CVE-2026-24515 [LOW] CWE-476 libexpat: libexpat null pointer dereference
libexpat: libexpat null pointer dereference
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
A null pointer dereference flaw has been discovered in libexpat. The function `XML_ExternalEntityParserCreate` failed to copy the encoding handler data passed to XML_SetUnknownEncodingHandler from the parent to the new subparser. This can cause a NULL dereference from external entities that declare use of an unknown encoding. The expected impact is denial of service. It takes use of both functions `XML_ExternalEntityParserCreate` and `XML_SetUnknownEncodingHandler` for an application to be vulnerable.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security c
Debian
CVE-2026-24515: expat - In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown e...
vendor_debian·2026·CVSS 2.9
CVE-2026-24515 [LOW] CVE-2026-24515: expat - In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown e...
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.7.3-2)
sid: resolved (fixed in 2.7.3-2)
trixie: open
VulDB
libexpat up to 2.7.3 XML_ExternalEntityParserCreate null pointer dereference (Nessus ID 296261 / WID-SEC-2026-2189)
vuldb·2026-07-03·CVSS 2.5
CVE-2026-24515 [LOW] libexpat up to 2.7.3 XML_ExternalEntityParserCreate null pointer dereference (Nessus ID 296261 / WID-SEC-2026-2189)
A vulnerability was found in libexpat up to 2.7.3 and classified as problematic. Affected is the function XML_ExternalEntityParserCreate. The manipulation results in null pointer dereference.
This vulnerability was named CVE-2026-24515. The attack needs to be approached locally. There is no available exploit.
It is suggested to upgrade the affected component.
OSV
expat vulnerabilities
osv·2026-02-16·CVSS 2.5
CVE-2026-24515 [LOW] expat vulnerabilities
expat vulnerabilities
USN-8022-1 fixed vulnerabilities in Expat. This update provides the
corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that Expat incorrectly handled the initialization of parsers
for external entities. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-24515)
It was discovered that Expat incorrectly handled integer calculations when
allocating memory for XML tags. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2026-25210)
OSV
libxmltok vulnerabilities
osv·2026-02-11·CVSS 2.5
CVE-2026-24515 [LOW] libxmltok vulnerabilities
libxmltok vulnerabilities
It was discovered that Expat, contained within the xmltok library, incorrectly
handled the initialization of parsers for external entities. An attacker could
possibly use this issue to cause a denial of service. (CVE-2026-24515)
It was discovered that Expat, contained within the xmltok library, incorrectly
handled integer calculations when allocating memory for XML tags. An attacker
could possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-25210)
OSV
expat vulnerabilities
osv·2026-02-10·CVSS 7.5
CVE-2025-59375 [HIGH] expat vulnerabilities
expat vulnerabilities
It was discovered that Expat incorrectly handled memory when parsing certain
XML files. An attacker could possibly use this issue to cause a denial of
service. This issue was only addressed in Ubuntu 25.10. (CVE-2025-59375)
It was discovered that Expat incorrectly handled the initialization of parsers
for external entities. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-24515)
It was discovered that Expat incorrectly handled integer calculations when
allocating memory for XML tags. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2026-25210)
OSV
CVE-2026-24515: In libexpat before 2
osv·2026-01-23·CVSS 2.5
CVE-2026-24515 [LOW] CVE-2026-24515: In libexpat before 2
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
GHSA
GHSA-mpwv-4wmh-cvf7: In libexpat before 2
ghsa_unreviewed·2026-01-23
CVE-2026-24515 [LOW] CWE-476 GHSA-mpwv-4wmh-cvf7: In libexpat before 2
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-24515 expat: libexpat null pointer dereference [fedora-42]
bugzilla·2026-01-27·CVSS 2.5
CVE-2026-24515 [LOW] CVE-2026-24515 expat: libexpat null pointer dereference [fedora-42]
CVE-2026-24515 expat: libexpat null pointer dereference [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, change the 'version'
to a lat
Bugzilla
CVE-2026-24515 libexpat: libexpat null pointer dereference
bugzilla·2026-01-23·CVSS 2.5
CVE-2026-24515 [LOW] CVE-2026-24515 libexpat: libexpat null pointer dereference
CVE-2026-24515 libexpat: libexpat null pointer dereference
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
Wiz
CVE-2026-24515 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 2.9
CVE-2026-24515 [LOW] CVE-2026-24515 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-24515 :
Alma Linux vulnerability analysis and mitigation
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
Source : NVD
## 2.5
Score
Published January 23, 2026
Severity LOW
CNA Score 2.9
Affected Technologies
Alma Linux
CBL Mariner
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 0.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
mingw-expat
libexpat1-32bit
Sources
NVD
Alpine 3.20, 3.21, 3.22, 3.23 Severity LOW Has Fix Added at: Feb 04, 2026
Alpine edge Severity LOW Has Fix Added at: Feb 03, 2026
CBL-Mariner 2.0 Severity LOW Has Fix Added at: Feb 08, 2026
CBL-Mariner 3.0 Severity LOW Has
2026-01-23
Published