Libexpat Project Libexpat
26 CVEs affecting Libexpat Project Libexpat. Latest disclosed: 2026-08-20. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66046 | High | 7.5 | 2026-08-18 | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where proc… |
CVE-2025-59375 | High | 7.5 | 2025-09-15 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |
CVE-2026-56411 | Medium | 6.9 | 2026-06-21 | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. |
CVE-2026-56410 | Medium | 6.9 | 2026-06-21 | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. |
CVE-2026-56408 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in copyString. |
CVE-2026-56407 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. |
CVE-2026-56406 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. |
CVE-2026-56405 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in getAttributeId. |
CVE-2026-56404 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in addBinding. |
CVE-2026-56403 | Medium | 6.9 | 2026-06-21 | libexpat before 2.8.2 has an integer overflow in storeAtts. |
CVE-2026-56132 | Medium | 6.9 | 2026-06-19 | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there… |
CVE-2026-25210 | Medium | 6.9 | 2026-01-30 | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer… |
CVE-2026-56409 | Medium | 6.5 | 2026-06-21 | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. |
CVE-2026-72522 | Medium | 6.2 | 2026-08-10 | libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode proce… |
CVE-2026-76956 | Medium | 5.9 | 2026-08-20 | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to has… |
CVE-2026-76957 | Medium | 4.9 | 2026-08-20 | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-502… |
CVE-2026-56412 | Medium | 4.9 | 2026-06-21 | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers… |
CVE-2026-56131 | Medium | 4.9 | 2026-06-19 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-fr… |
CVE-2026-50219 | Medium | 4.9 | 2026-06-04 | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within… |
CVE-2026-32777 | Medium | 4.0 | 2026-03-16 | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. |