AZL-113822: CVE-2026-128241 affecting package expat 2.9.0-1

Q: What conditions are required for exploitation?

An attacker needs local access and write permission to the directory selected for xmlwf output. Exploitation requires xmlwf to be run with the -d output mode so the attacker can place a symbolic link at an expected output filename.

Q: Which environments are most exposed?

Systems where xmlwf runs with -d against an output directory writable by less-trusted local users are exposed. The impact is limited to files that are writable by the user running xmlwf, which may be truncated or overwritten through a planted symlink.

Q: What can be done before a patch is available?

Do not run xmlwf with -d using directories writable by untrusted users. Restrict write access to output directories and ensure they cannot contain attacker-created symbolic links.

Q: How can I assess whether this affects current use?

Review whether xmlwf is invoked with the -d option and identify the permissions on its output directories. Also verify the installed libexpat version, as the issue is described as affecting libexpat through 2.10.0; the listed package is expat 2.9.0-1.

Published Nov 13, 2026

Updated

The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.

Affected Software

1 affected component

azure-linux/expat<=2.9.0-1

Event History

Nov 13, 2026

Advisory Published

via OSV·10:18 AM

Data Sourced

via OSV·10:18 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-128241

Frequently Asked Questions

What conditions are required for exploitation?

An attacker needs local access and write permission to the directory selected for xmlwf output. Exploitation requires xmlwf to be run with the -d output mode so the attacker can place a symbolic link at an expected output filename.

Which environments are most exposed?

Systems where xmlwf runs with -d against an output directory writable by less-trusted local users are exposed. The impact is limited to files that are writable by the user running xmlwf, which may be truncated or overwritten through a planted symlink.

What can be done before a patch is available?

Do not run xmlwf with -d using directories writable by untrusted users. Restrict write access to output directories and ensure they cannot contain attacker-created symbolic links.

How can I assess whether this affects current use?

Review whether xmlwf is invoked with the -d option and identify the permissions on its output directories. Also verify the installed libexpat version, as the issue is described as affecting libexpat through 2.10.0; the listed package is expat 2.9.0-1.

AZL-113822: CVE-2026-128241 affecting package expat 2.9.0-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

Which environments are most exposed?

What can be done before a patch is available?

How can I assess whether this affects current use?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which environments are most exposed?

What can be done before a patch is available?

How can I assess whether this affects current use?