Libexpat Project Libexpat vulnerabilities

CVE-2026-56408 [MEDIUM] CWE-190 CVE-2026-56408: libexpat before 2.8.2 has an integer overflow in copyString. libexpat before 2.8.2 has an integer overflow in copyString.

CVE-2026-56403 [MEDIUM] CWE-190 CVE-2026-56403: libexpat before 2.8.2 has an integer overflow in storeAtts. libexpat before 2.8.2 has an integer overflow in storeAtts.

CVE-2026-56405 [MEDIUM] CWE-190 CVE-2026-56405: libexpat before 2.8.2 has an integer overflow in getAttributeId. libexpat before 2.8.2 has an integer overflow in getAttributeId.

CVE-2026-56407 [MEDIUM] CWE-190 CVE-2026-56407: libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and en libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

CVE-2026-56406 [MEDIUM] CWE-190 CVE-2026-56406: libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.

CVE-2012-6702 [MEDIUM] CWE-310 CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.

CVE-2026-56409 [MEDIUM] CWE-190 CVE-2026-56409: xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

CVE-2026-50219 [MEDIUM] CWE-416 CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_P libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

CVE-2024-50602 [MEDIUM] CWE-754 CVE-2024-50602: An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser funct An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

CVE-2026-56412 [MEDIUM] CVE-2026-56412: libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

CVE-2023-52426 [MEDIUM] CWE-776 CVE-2023-52426: libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

CVE-2026-32778 [MEDIUM] CWE-476 CVE-2026-32778: libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.

CVE-2012-0876 [MEDIUM] CWE-400 CVE-2012-0876: The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the abili The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

CVE-2012-1148 [MEDIUM] CWE-399 CVE-2012-1148: Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-de Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.

CVE-2026-32777 [MEDIUM] CWE-835 CVE-2026-32777: libexpat before 2.7.5 allows an infinite loop while parsing DTD content. libexpat before 2.7.5 allows an infinite loop while parsing DTD content.

CVE-2025-66382 [MEDIUM] CWE-407 CVE-2025-66382: In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of se In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

CVE-2026-32776 [MEDIUM] CWE-476 CVE-2026-32776: libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.

CVE-2026-56131 [MEDIUM] CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within ha libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).

CVE-2012-1147 [MEDIUM] CWE-20 CVE-2012-1147: readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.

CVE-2026-41080 [LOW] CWE-331 CVE-2026-41080: libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.