CVE-2026-32778: Null Pointer Dereference
Published Mar 16, 2026
·Updated
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
Affected Software
5 affected componentsFixes available
libexpat<2.7.5
Libexpat Project Libexpat<2.7.5
Microsoft azl3 expat 2.6.4-4
Microsoft azl3 expat 2.6.4-5
Microsoft cbl2 expat 2.6.4-4
Remediation
Patch Available
Patch Available
Event History
Mar 16, 2026
CVE Published
via MITRE·07:02 AM
Data Sourced
via MITRE·07:02 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Mar 17, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:01 AM
Severity
Updated
via Microsoft·08:01 AM
Affected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-32778?
CVE-2026-32778 has a medium severity rating due to the potential for a NULL pointer dereference that can lead to application crashes.
2
How do I fix CVE-2026-32778?
To fix CVE-2026-32778, upgrade libexpat to version 2.7.5 or later.
3
What software is affected by CVE-2026-32778?
CVE-2026-32778 affects libexpat versions prior to 2.7.5.
4
What type of vulnerability is CVE-2026-32778?
CVE-2026-32778 is a NULL pointer dereference vulnerability.
5
What risks does CVE-2026-32778 pose?
CVE-2026-32778 can lead to application crashes and potentially impact system stability.