Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between ELEMENTTYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XMLUNICODE and to silently replace input characters in other builds.
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.
The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution.
It was found that original patch for issues CVE-2015-1283 and CVE-2015-2716 used overflow checks that could be optimized out by some compilers applying certain optimization settings, which can cause the vulnerability to remain even after applying the patch.
One pattern in the fix for CVE-2015-1283/CVE-2015-2716 is:
/ bufferSize is positive here / do { bufferSize = 2; } while (bufferSize < neededSize && bufferSize > 0); if (bufferSize <= 0) { errorCode = XMLERRORNOMEMORY; return NULL;
Any of the modern optimizing compiler, IF able to infer that bufferSize is initially positive (which is true but not obvious to see through local reasoning), will eliminate bufferSize > 0 as always true when the execution is defined, and bufferSize <= 0 as always false when the execution is defined.
Without knowing that bufferSize starts positive, an optimizing compiler could also move the test bufferSize > 0 out of the loop, that is, compile the code as if it had been written:
if (bufferSize <= 0) errorCode = XMLERRORNOMEMORY; return NULL; else { do { bufferSize = 2; } while (bufferSize < neededSize); }
Both cases leads to not eliminating the vulnerability.
Upstream patch:
https://sourceforge.net/p/expat/codegit/ci/f0bec73b018caa07d3e75ec8dd967f3785d71bde/tree/expat/lib/xmlparse.c?diff=a238d7ea7a715ef3850c4cbdd86aeda7077b6bbc
Hello oss-security,
just a quick note that libexpat 2.8.5 (or "Expat 2.8.5") released today is fixing CVE-2026-93990:
Reject high surrogates not followed by a low surrogate during UTF-16 decoding; previously, malformed UTF-16 could be smuggled into the application using Expat and could cause arbitrary damage there, depending on how malformed UTF-16 was handled inside the application; validation was not their job but Expat's. This is similar to past vulnerability CVE-2022-25235. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)
Some key links are:
- The blog post about it https://blog.hartwork.org/posts/expat-2-8-5-released/
- The change log of release 2.8.5 https://github.com/libexpat/libexpat/blob/R285/expat/Changes
- The fixing pull request https://github.com/libexpat/libexpat/pull/1282
- The NVD CVE metadata https://nvd.nist.gov/vuln/detail/CVE-2026-93990 (with a different CVSS vector)
Best
Sebastian
Hello oss-security,
just a quick note that libexpat 2.9.0 (or "Expat 2.9.0") released today is fixing two vulnerabilities:
- CVE-2026-77214 - CVE-2026-102633
The related part of the change log is this:
#1392 CVE-2026-102633 -- Integer overflow in function expatrealloc on 32bit platforms #1393 CVE-2026-77214 -- Validate parameter len against available buffer capacity in XMLParseBuffer
Some key links are:
- The blog post about it https://blog.hartwork.org/posts/expat-2-9-0-released/
- The full change log of release 2.9.0 https://github.com/libexpat/libexpat/blob/R290/expat/Changes
- The fixing pull requests - https://github.com/libexpat/libexpat/pull/1392 - https://github.com/libexpat/libexpat/pull/1393
- The NVD CVE metadata - https://nvd.nist.gov/vuln/detail/cve-2026-77214 - https://nvd.nist.gov/vuln/detail/cve-2026-102633
Best
Sebastian
Hello oss-security,
just a quick note that libexpat 2.10.0 (or "Expat 2.10.0") released today is fixing four vulnerabilities:
- CVE-2026-113351 - CVE-2026-115506 - CVE-2026-117610 - CVE-2026-118370
The related part of the change log is this:
#1431 CVE-2026-113351 -- Fix denial of service with use of XMLParserReset #1433 #1436 .. #1438 #1439 .. #1442 CVE-2026-115506 -- Detect billion laughs attacks quicker and more of its variations. Related payload fuzzer at: https://github.com/hannob/lololol Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. In case of backporting, please note pull request #1439 in particular. #1444 CVE-2026-117610 -- Fix initial non-final empty subparser parse calls. Was segfaulting previously. #1450 CVE-2026-118370 -- Protect attIndex and nPrefixes in function storeAtts from signed integer overflow
Some key links are:
- The blog post about it https://blog.hartwork.org/posts/expat-2-10-0-released/
- The full change log of release 2.10.0 https://github.com/libexpat/libexpat/blob/R2100/expat/Changes
- The fixing pull requests - https://github.com/libexpat/libexpat/pull/1431 - https://github.com/libexpat/libexpat/pull/1433 - https://github.com/libexpat/libexpat/pull/1439 - https://github.com/libexpat/libexpat/pull/1444 - https://github.com/libexpat/libexpat/pull/1450
- The NVD CVE metadata - https://nvd.nist.gov/vuln/detail/cve-2026-113351 - https://nvd.nist.gov/vuln/detail/cve-2026-115506 - https://nvd.nist.gov/vuln/detail/cve-2026-117610 - https://nvd.nist.gov/vuln/detail/cve-2026-118370
Best
Sebastian
USN-4132-1 fixed a vulnerability in Expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.
It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.
USN-4040-1 fixed a vulnerability in expat. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that Expat incorrectly handled certain XML files. An attacker could possibly use this issue to cause a denial of service.
It was discovered that Expat incorrectly handled malformed XML data. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code.