Libexpat Project vulnerabilities
26 CVEs and advisories name Libexpat Project as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-76957libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks.
- CVE-2026-76956In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in bein
- CVE-2026-66046Expat Denial of Service via storeAtts() Quadratic Complexity
- CVE-2026-72522libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates…
- CVE-2026-56412libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls…
- CVE-2026-56411xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
- CVE-2026-56410xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
- CVE-2026-56409xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
- CVE-2026-56408libexpat before 2.8.2 has an integer overflow in copyString.
- CVE-2026-56407libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
- CVE-2026-56406libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
- CVE-2026-56405libexpat before 2.8.2 has an integer overflow in getAttributeId.
- CVE-2026-56404libexpat before 2.8.2 has an integer overflow in addBinding.
- CVE-2026-56403libexpat before 2.8.2 has an integer overflow in storeAtts.
- CVE-2026-56132In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is…
- CVE-2026-56131libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation.
- CVE-2026-50219libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or…
- CVE-2026-45186In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized…
- CVE-2026-41080libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
- CVE-2026-32778libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
- CVE-2026-32777libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
- CVE-2026-32776libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
- CVE-2026-25210In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow…
- CVE-2026-24515In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
- CVE-2025-66382In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
- CVE-2025-59375libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for…