CVE-2026-76641

EUVD-2026-63493

20.08.2026, 18:16

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 26.72%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
libexpat_project	libexpat	𝑥 ≤ 2.8.3	CNA

Debian Releases

Debian Product

Codename

expat

bookworm	2.5.0-1+deb12u2 fixed
bookworm (security)	2.5.0-1+deb12u3 fixed
forky	2.8.4-2 fixed
sid	2.8.5-1 fixed
trixie	2.8.3-1~deb13u1 fixed
trixie (security)	2.8.3-1~deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

expat

bionic	Fixed 2.2.5-3ubuntu0.9+esm5 released
focal	Fixed 2.2.9-1ubuntu0.8+esm3 released
jammy	Fixed 2.4.7-1ubuntu0.9 released
noble	Fixed 2.6.1-2ubuntu0.6 released
resolute	Fixed 2.7.4-1ubuntu0.2 released
trusty	Fixed 2.1.0-4ubuntu1.4+esm13 released
xenial	Fixed 2.1.0-7ubuntu0.16.04.5+esm14 released

apache2

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
trusty	not-affected
xenial	not-affected

apr-util

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
trusty	not-affected
xenial	not-affected

cmake

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
xenial	not-affected

ghostscript

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
xenial	not-affected

texlive-bin

bionic	not-affected
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
xenial	not-affected

xmlrpc-c

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
trusty	needs-triage
xenial	needs-triage

vnc4

bionic	needs-triage
jammy	dne
noble	dne
resolute	dne
trusty	needs-triage
xenial	needs-triage

wbxml2

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

swish-e

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

insighttoolkit4

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	dne
resolute	dne
xenial	needs-triage

cadaver

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

gdcm

bionic	needs-triage
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
trusty	not-affected
xenial	needs-triage

ayttm

jammy	dne
noble	dne
resolute	dne
xenial	needs-triage

cableswig

jammy	dne
noble	dne
resolute	dne
xenial	needs-triage

coin3

bionic	needs-triage
focal	not-affected
jammy	not-affected
noble	not-affected
resolute	not-affected
trusty	needs-triage
xenial	needs-triage

matanza

bionic	needs-triage
focal	ignored
jammy	ignored
noble	ignored
resolute	ignored
xenial	needs-triage

tdom

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

vtk

jammy	dne
noble	dne
resolute	dne
trusty	needs-triage
xenial	needs-triage

smart

bionic	needs-triage
jammy	dne
noble	dne
resolute	dne
xenial	needs-triage

firefox

jammy	not-affected
noble	not-affected
resolute	not-affected

thunderbird

jammy	not-affected
noble	not-affected
resolute	not-affected

libxmltok

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	dne
xenial	needs-triage

Azure Linux Releases

Azure Package

Release

expat

Azure Linux 3.0

0:2.8.3-2.azl3

fixed

Common Weakness Enumeration

CWE-125 - Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.

References

https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf

https://github.com/libexpat/libexpat/pull/1331

https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy