Hello oss-security,

just a quick note that libexpat 2.9.0 (or "Expat 2.9.0") released today is fixing two vulnerabilities:

- CVE-2026-77214 - CVE-2026-102633

The related part of the change log is this:

#1392 CVE-2026-102633 -- Integer overflow in function expatrealloc on 32bit platforms #1393 CVE-2026-77214 -- Validate parameter len against available buffer capacity in XMLParseBuffer

Some key links are:

- The blog post about it https://blog.hartwork.org/posts/expat-2-9-0-released/

- The full change log of release 2.9.0 https://github.com/libexpat/libexpat/blob/R290/expat/Changes

- The fixing pull requests - https://github.com/libexpat/libexpat/pull/1392 - https://github.com/libexpat/libexpat/pull/1393

- The NVD CVE metadata - https://nvd.nist.gov/vuln/detail/cve-2026-77214 - https://nvd.nist.gov/vuln/detail/cve-2026-102633

Best

Sebastian

Hello oss-security,

just a quick note that libexpat 2.8.5 (or "Expat 2.8.5") released today is fixing CVE-2026-93990:

Reject high surrogates not followed by a low surrogate during UTF-16 decoding; previously, malformed UTF-16 could be smuggled into the application using Expat and could cause arbitrary damage there, depending on how malformed UTF-16 was handled inside the application; validation was not their job but Expat's. This is similar to past vulnerability CVE-2022-25235. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)

Some key links are:

- The blog post about it https://blog.hartwork.org/posts/expat-2-8-5-released/

- The change log of release 2.8.5 https://github.com/libexpat/libexpat/blob/R285/expat/Changes

- The fixing pull request https://github.com/libexpat/libexpat/pull/1282

- The NVD CVE metadata https://nvd.nist.gov/vuln/detail/CVE-2026-93990 (with a different CVSS vector)

Best

Sebastian

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XMLUNICODE and to silently replace input characters in other builds.

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

USN-4132-1 fixed a vulnerability in Expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.

It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.

USN-4040-1 fixed a vulnerability in expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to cause a denial of service.

It was found that original patch for issues CVE-2015-1283 and CVE-2015-2716 used overflow checks that could be optimized out by some compilers applying certain optimization settings, which can cause the vulnerability to remain even after applying the patch.

One pattern in the fix for CVE-2015-1283/CVE-2015-2716 is:

/ bufferSize is positive here / do { bufferSize = 2; } while (bufferSize < neededSize && bufferSize > 0); if (bufferSize <= 0) { errorCode = XMLERRORNOMEMORY; return NULL;

Any of the modern optimizing compiler, IF able to infer that bufferSize is initially positive (which is true but not obvious to see through local reasoning), will eliminate bufferSize > 0 as always true when the execution is defined, and bufferSize <= 0 as always false when the execution is defined.

Without knowing that bufferSize starts positive, an optimizing compiler could also move the test bufferSize > 0 out of the loop, that is, compile the code as if it had been written:

if (bufferSize <= 0) errorCode = XMLERRORNOMEMORY; return NULL; else { do { bufferSize = 2; } while (bufferSize < neededSize); }

Both cases leads to not eliminating the vulnerability.

Upstream patch:

https://sourceforge.net/p/expat/codegit/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde/tree/expat/lib/xmlparse.c?diff=a238d7ea7a715ef3850c4cbdd86aeda7077b6bbc

The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.

It was discovered that Expat incorrectly handled malformed XML data. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code.