Libexpat_project Libexpat
62 CVEs affecting Libexpat_project Libexpat. Latest disclosed: 2026-06-21. Critical: 10, High: 20.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-45492 | Critical | 9.8 | 2024-08-30 | An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_M… |
CVE-2024-45491 | Critical | 9.8 | 2024-08-30 | An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equal… |
CVE-2022-25315 | Critical | 9.8 | 2022-02-18 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. |
CVE-2022-25236 | Critical | 9.8 | 2022-02-16 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. |
CVE-2022-25235 | Critical | 9.8 | 2022-02-16 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain con… |
CVE-2022-23852 | Critical | 9.8 | 2022-01-24 | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. |
CVE-2022-22824 | Critical | 9.8 | 2022-01-10 | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22823 | Critical | 9.8 | 2022-01-10 | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22822 | Critical | 9.8 | 2022-01-10 | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2016-0718 | Critical | 9.8 | 2016-05-26 | Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers… |
CVE-2022-22827 | High | 8.8 | 2022-01-10 | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22826 | High | 8.8 | 2022-01-10 | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2022-22825 | High | 8.8 | 2022-01-10 | lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. |
CVE-2021-45960 | High | 8.8 | 2022-01-01 | In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., alloca… |
CVE-2022-40674 | High | 8.1 | 2022-09-14 | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. |
CVE-2021-46143 | High | 8.1 | 2022-01-06 | In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. |
CVE-2016-4472 | High | 8.1 | 2016-06-30 | The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash)… |
CVE-2017-11742 | High | 7.8 | 2017-07-30 | The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan hor… |
CVE-2026-7210 | High | 7.5 | 2026-05-11 | `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger has… |
CVE-2025-59375 | High | 7.5 | 2025-09-15 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. |