AZL-112841: CVE-2026-124317 affecting package expat 2.9.0-1

Q: Which applications are exposed to this issue?

Applications using libexpat are exposed when they register and process an unknown encoding. The vulnerable paths are unknown_toUtf8() and unknown_toUtf16() in xmltok.c.

Q: What must an attacker provide to trigger the vulnerability?

An attacker must be able to supply an XML document processed with an application-registered unknown encoding. The document must end in a truncated multibyte sequence, causing the encoding conversion callback to read beyond the parse buffer.

Q: What is the potential impact of successful exploitation?

The out-of-bounds read can leak memory adjacent to the parse buffer or crash the affected application.

Published Nov 7, 2026

Updated

libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknowntoUtf8() and unknowntoUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.

Affected Software

1 affected component

azure-linux/expat<=2.9.0-1

Event History

Nov 7, 2026

Advisory Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-124317

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using libexpat are exposed when they register and process an unknown encoding. The vulnerable paths are unknown_toUtf8() and unknown_toUtf16() in xmltok.c.

What must an attacker provide to trigger the vulnerability?

An attacker must be able to supply an XML document processed with an application-registered unknown encoding. The document must end in a truncated multibyte sequence, causing the encoding conversion callback to read beyond the parse buffer.

What is the potential impact of successful exploitation?

The out-of-bounds read can leak memory adjacent to the parse buffer or crash the affected application.

AZL-112841: CVE-2026-124317 affecting package expat 2.9.0-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker provide to trigger the vulnerability?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What must an attacker provide to trigger the vulnerability?

What is the potential impact of successful exploitation?