libexpat project vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 202624

Newest CVEs

• CVE-2026-76957

  libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to…

  libexpat project · libexpat

  Medium4.9
• CVE-2026-76956

  In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to…

  libexpat project · libexpat

  Medium5.9
• CVE-2026-66046

  Expat Denial of Service via storeAtts() Quadratic Complexity

  libexpat project · libexpat

  High8.7
• CVE-2026-72522

  libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode…

  libexpat project · libexpat

  Medium6.2
• CVE-2026-56412

  libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers…

  libexpat project · libexpat

  Medium4.9
• CVE-2026-56411

  xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

  libexpat project · libexpat

  Medium6.9
• CVE-2026-56410

  xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.

  libexpat project · libexpat

  Medium6.9
• CVE-2026-56409

  xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

  libexpat project · libexpat

  Medium6.5
• CVE-2026-56408

  libexpat before 2.8.2 has an integer overflow in copyString.

  libexpat project · libexpat

  Medium6.9
• CVE-2026-56407

  libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

  libexpat project · libexpat

  Medium6.9