AZL-111145: CVE-2026-117610 affecting package expat 2.8.3-2

Q: What conditions are required for an attacker to trigger the crash?

The attacker must be able to control stream chunking for XML parsing and cause an empty, non-final first parse on an external entity subparser. The issue is triggered later when parsing continues, causing the application to crash.

Q: What is the practical impact of successful exploitation?

Successful exploitation causes a NULL pointer dereference in libexpat and crashes the application. The provided information describes a denial-of-service impact; it does not indicate code execution or data exposure.

Q: Which versions are affected?

libexpat through version 2.9.0 is affected. The reported Azure Linux package is expat 2.8.3-2.

Published Oct 28, 2026

Updated

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

Affected Software

1 affected component

azure-linux/expat<=2.8.3-2

Event History

Oct 28, 2026

Advisory Published

via OSV·03:17 AM

Data Sourced

via OSV·03:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-117610

Frequently Asked Questions

What conditions are required for an attacker to trigger the crash?

The attacker must be able to control stream chunking for XML parsing and cause an empty, non-final first parse on an external entity subparser. The issue is triggered later when parsing continues, causing the application to crash.

What is the practical impact of successful exploitation?

Successful exploitation causes a NULL pointer dereference in libexpat and crashes the application. The provided information describes a denial-of-service impact; it does not indicate code execution or data exposure.

Which versions are affected?

libexpat through version 2.9.0 is affected. The reported Azure Linux package is expat 2.8.3-2.

AZL-111145: CVE-2026-117610 affecting package expat 2.8.3-2

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for an attacker to trigger the crash?

What is the practical impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for an attacker to trigger the crash?

What is the practical impact of successful exploitation?

Which versions are affected?