AZL-112412: CVE-2026-117610 affecting package cmake 3.30.3-15

Q: What conditions are required to trigger the crash?

An attacker must be able to supply XML that causes an external entity subparser to be used and control how the input stream is chunked. The first parse for that external entity must be empty and non-final, allowing a later parse to trigger the NULL pointer dereference.

Q: What is the practical impact of successful exploitation?

Successful exploitation crashes the application parsing the XML. The provided information describes a denial-of-service condition and does not establish code execution or data exposure.

Q: How can I determine whether my environment is exposed?

Review whether the affected cmake package includes libexpat through version 2.9.0 and whether applications using it parse attacker-controlled XML with external entities enabled or processed. Exposure also depends on whether an attacker can influence stream chunking for the XML input.

Published Oct 28, 2026

Updated

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

Affected Software

1 affected component

azure-linux/cmake<=3.30.3-15

Event History

Oct 28, 2026

Advisory Published

via OSV·03:17 AM

Data Sourced

via OSV·03:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-117610

Frequently Asked Questions

What conditions are required to trigger the crash?

An attacker must be able to supply XML that causes an external entity subparser to be used and control how the input stream is chunked. The first parse for that external entity must be empty and non-final, allowing a later parse to trigger the NULL pointer dereference.

What is the practical impact of successful exploitation?

Successful exploitation crashes the application parsing the XML. The provided information describes a denial-of-service condition and does not establish code execution or data exposure.

How can I determine whether my environment is exposed?

Review whether the affected cmake package includes libexpat through version 2.9.0 and whether applications using it parse attacker-controlled XML with external entities enabled or processed. Exposure also depends on whether an attacker can influence stream chunking for the XML input.

AZL-112412: CVE-2026-117610 affecting package cmake 3.30.3-15

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the practical impact of successful exploitation?

How can I determine whether my environment is exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash?

What is the practical impact of successful exploitation?

How can I determine whether my environment is exposed?