CVE-2026-76641: Expat Out-of-Bounds Read via dtdCopy
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Expatto a version that resolves this vulnerability.Fixed in 2.8.3Patch CVE-2026-66046 - Compensating control
If using Expat, avoid creating external entity parsers via XML_ExternalEntityParserCreate; do not enable external entity processing so attackers cannot trigger the out-of-bounds read/memory corruption path.
Event History
Frequently Asked Questions
Which deployments are exposed to the described exploit path?
Deployments using Expat through 2.8.3 are exposed when they process attacker-controlled XML using external entity parsers created with XML_ExternalEntityParserCreate.
What does an attacker need to do to trigger the issue?
An attacker needs to supply XML that is processed through an external entity parser created via XML_ExternalEntityParserCreate. The vulnerable path involves non-CDATA attribute handling in storeAtts.
What is the expected impact of successful exploitation?
The issue can cause an out-of-bounds read that may lead to a wild pointer dereference and segmentation fault. The supplied severity vector identifies availability impact, with no stated confidentiality or integrity impact.
What can be done while an update is not available?
Avoid processing untrusted XML through external entity parsers created with XML_ExternalEntityParserCreate where possible. That parser-creation and XML-processing path is specifically required for the described vulnerability.