UBUNTU-CVE-2026-124317: Medium severity ubuntu/coin3 vulnerability
libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknowntoUtf8() and unknowntoUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to provide to trigger the issue?
The attacker must be able to supply an XML document processed with an application-registered unknown encoding. The document must end in a truncated multibyte sequence, causing the encoding conversion callback to read beyond the parse buffer.
What is the practical impact of successful exploitation?
The out-of-bounds read can leak adjacent memory or crash the affected application. No privileges or user interaction are required according to the supplied vector, but exploitation has high attack complexity.
Which Ubuntu software entries are identified as affected?
The listed entries are ubuntu/expat, ubuntu/xmlrpc-c, ubuntu/cadaver, ubuntu/matanza, ubuntu/swish-e, ubuntu/tdom, ubuntu/wbxml2, and ubuntu/libxmltok. The vulnerable libexpat range is through version 2.10.0.