E
Expat
Security Risk Profile
49
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 43 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from August 31, 2015 to present
43
Total CVEs
8
Critical+High
0
Exploited
3
Unpatched
Threat Assessment
Avg CVSS
6.2
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
3
Critical/High
Risk Level
49/100
medium
🆕 2Fresh (<7d)📈 3 in Last 30 Days
Severity Distribution
Critical
0High
8Medium
21Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
2Age Distribution
Common Weaknesses (CWE)
1
Integer Overflow
11
2
Use After Free
5
3
Buffer Overflow
2
4
Input Validation
2
5
Race Condition
1
Most Affected Products
1. Expat libexpat29
2. debian/expat16
3. Libexpat Project Libexpat16
4. Expat Expat14
5. Microsoft azl3 expat 2.6.4-614
Recent Vulnerabilities
See more →https://seclists.org/oss-sec/2026/q3/863
unknown
libexpat 2.8.5 fixes CVE-2026-93990 (malformed UTF-16 smuggling)
Sep 22, 2026🔧 No Patch
CVE-2026-93990
CVSS 8.7EPSS 0%high
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
Sep 19, 2026🔧 No Patch
CVE-2026-76641
CVSS 8.7high
Expat Out-of-Bounds Read via dtdCopy
Aug 20, 2026
CVE-2026-56412
CVSS 5.9medium
Jun 21, 2026
CVE-2026-56411
CVSS 6.9medium
Jun 21, 2026
CVE-2026-56410
CVSS 6.9medium
Jun 21, 2026
CVE-2026-56409
CVSS 6.5medium
Jun 21, 2026
CVE-2026-56408
CVSS 6.9medium
Jun 21, 2026
CVE-2026-56407
CVSS 6.9medium
Jun 21, 2026
CVE-2026-56406
CVSS 6.9medium
Jun 21, 2026
Monitor Expat in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.