CVE-2026-117610: libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using libexpat through 2.9.0 are exposed if they parse external entities and an attacker can control how the external entity data is chunked.
What must an attacker be able to do to trigger the crash?
The attacker must cause an external entity subparser to receive an empty, non-final first parse, followed by a later parse. This requires control over stream chunking; no privileges or user interaction are required according to the supplied vector.
What is the impact of successful exploitation?
Successful exploitation crashes the application through a NULL pointer dereference, resulting in a denial of service. The supplied impact data indicates no confidentiality or integrity impact.