# cve.now: Libexpat Project

The newest entries naming Libexpat Project as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-76957](https://cve.now/CVE-2026-76957.md): libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (CVSS 4.9)
- [CVE-2026-76956](https://cve.now/CVE-2026-76956.md): In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in bein (CVSS 5.9)
- [CVE-2026-66046](https://cve.now/CVE-2026-66046.md): Expat Denial of Service via storeAtts() Quadratic Complexity (CVSS 8.7)
- [CVE-2026-72522](https://cve.now/CVE-2026-72522.md): libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates… (CVSS 6.2)
- [CVE-2026-56412](https://cve.now/CVE-2026-56412.md): libexpat before 2.8.2 does not consider XML\_TOK\_DATA\_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls… (CVSS 4.9)
- [CVE-2026-56411](https://cve.now/CVE-2026-56411.md): xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. (CVSS 6.9)
- [CVE-2026-56410](https://cve.now/CVE-2026-56410.md): xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. (CVSS 6.9)
- [CVE-2026-56409](https://cve.now/CVE-2026-56409.md): xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. (CVSS 6.5)
- [CVE-2026-56408](https://cve.now/CVE-2026-56408.md): libexpat before 2.8.2 has an integer overflow in copyString. (CVSS 6.9)
- [CVE-2026-56407](https://cve.now/CVE-2026-56407.md): libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. (CVSS 6.9)
- [CVE-2026-56406](https://cve.now/CVE-2026-56406.md): libexpat before 2.8.2 has an integer overflow in XML\_ParseBuffer because it lacked a check that was present in XML\_Parse. (CVSS 6.9)
- [CVE-2026-56405](https://cve.now/CVE-2026-56405.md): libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVSS 6.9)
- [CVE-2026-56404](https://cve.now/CVE-2026-56404.md): libexpat before 2.8.2 has an integer overflow in addBinding. (CVSS 6.9)
- [CVE-2026-56403](https://cve.now/CVE-2026-56403.md): libexpat before 2.8.2 has an integer overflow in storeAtts. (CVSS 6.9)
- [CVE-2026-56132](https://cve.now/CVE-2026-56132.md): In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is… (CVSS 6.9)
- [CVE-2026-56131](https://cve.now/CVE-2026-56131.md): libexpat before 2.8.2 lacks handler call depth tracking for calls to XML\_ResumeParser from within handlers in cases of a policy violation. (CVSS 4.9)
- [CVE-2026-50219](https://cve.now/CVE-2026-50219.md): libexpat before 2.8.2 lacks handler call depth tracking for calls to XML\_GetBuffer, XML\_Parse, XML\_ParseBuffer, XML\_ParserFree, or… (CVSS 4.9)
- [CVE-2026-45186](https://cve.now/CVE-2026-45186.md): In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized… (CVSS 2.9)
- [CVE-2026-41080](https://cve.now/CVE-2026-41080.md): libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. (CVSS 2.9)
- [CVE-2026-32778](https://cve.now/CVE-2026-32778.md): libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. (CVSS 2.9)
- [CVE-2026-32777](https://cve.now/CVE-2026-32777.md): libexpat before 2.7.5 allows an infinite loop while parsing DTD content. (CVSS 4.0)
- [CVE-2026-32776](https://cve.now/CVE-2026-32776.md): libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. (CVSS 4.0)
- [CVE-2026-25210](https://cve.now/CVE-2026-25210.md): In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow… (CVSS 6.9)
- [CVE-2026-24515](https://cve.now/CVE-2026-24515.md): In libexpat before 2.7.4, XML\_ExternalEntityParserCreate does not copy unknown encoding handler user data. (CVSS 2.9)
- [CVE-2025-66382](https://cve.now/CVE-2025-66382.md): In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. (CVSS 2.9)
- [CVE-2025-59375](https://cve.now/CVE-2025-59375.md): libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for… (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/libexpat-project
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.