CVE-2026-77214: libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XMLParseBuffer advances the parse buffer end with parser->mbufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XMLParseBuffer calls move mbufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XMLParseBuffer returns XMLERRORNOBUFFER. A buffer is present after a prior call to XMLGetBuffer, either directly (the common case) or indirectly through a prior XMLParse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed in practice?
Applications that parse attacker-influenced XML with libexpat are exposed if their parsing flow uses XML_ParseBuffer after a parse buffer has been created. The buffer may have been created explicitly with XML_GetBuffer or internally by an earlier XML_Parse call.
What does an attacker need to reach the out-of-bounds read?
The attacker needs to cause repeated XML_ParseBuffer calls with caller-supplied lengths after a parse buffer already exists. If no parse buffer is present, XML_ParseBuffer returns XML_ERROR_NO_BUFFER instead of reaching this path.
What is the security impact of successful exploitation?
The out-of-bounds read can disclose adjacent heap memory to the calling application, including heap, libc function, and code pointers. This information can defeat ASLR and provide primitives for further exploitation.
What upstream fix should be used?
The issue affects libexpat before commit 13c5f63. The referenced upstream fix is commit 13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0.