CVE-2026-32776: Null Pointer Dereference
Published Mar 16, 2026
·Updated
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
Affected Software
5 affected componentsFixes available
redhat/libexpat<2.7.5
Libexpat Project Libexpat<2.7.5
Microsoft azl3 expat 2.6.4-4
Microsoft azl3 expat 2.6.4-5
Microsoft cbl2 expat 2.6.4-4
Remediation
Patch Available
Patch Available
Event History
Mar 16, 2026
CVE Published
via MITRE·06:54 AM
Data Sourced
via MITRE·06:54 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 17, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:01 AM
Severity
Updated
via Microsoft·08:01 AM
Affected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-32776?
CVE-2026-32776 is classified as a high severity vulnerability due to its potential to cause application crashes through NULL pointer dereferences.
2
How do I fix CVE-2026-32776?
To fix CVE-2026-32776, upgrade to libexpat version 2.7.5 or later.
3
What systems are affected by CVE-2026-32776?
CVE-2026-32776 affects libexpat versions prior to 2.7.5 on any system utilizing the library.
4
What type of vulnerability is CVE-2026-32776?
CVE-2026-32776 is a NULL pointer dereference vulnerability related to empty external parameter entity content.
5
Can CVE-2026-32776 be exploited remotely?
CVE-2026-32776 can potentially be exploited remotely if the affected software is processing untrusted input.