https://seclists.org/oss-sec/2026/q4/55: libexpat 2.9.0 fixes two vulnerabilities
Published Oct 5, 2026
·Updated
Affected Software
1 affected component
Expat Expat<2.9.0
Frequently Asked Questions
1
Which environments are affected by the integer overflow issue?
The integer overflow in expat_realloc, tracked as CVE-2026-102633, affects 32-bit platforms.
2
What condition is addressed by the XML_ParseBuffer fix?
CVE-2026-77214 addresses XML_ParseBuffer failing to validate its len parameter against the available buffer capacity.
3
Which release contains fixes for both issues?
Both CVE-2026-77214 and CVE-2026-102633 are fixed in libexpat 2.9.0.