Libexpat vulnerabilities
We track 9 vulnerabilities in Libexpat products across 2 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest Libexpat vulnerabilities
- 8.2 High severity
libexpat: Integer Overflow or Wraparound
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carry
- 7.5 High severity
libexpat: NULL Pointer Dereference
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse
- 7.5 High severity
libexpat: Improper Restriction of Recursive Entity References in DTDs
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nest
- 7.5 High severity
libexpat: Missing Initialization of Resource
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail
- 8.2 High severity
libexpat: Out-of-bounds Read
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, s
- 7.5 High severity
libexpat: Improper Handling of Unicode Encoding
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following co
- 7.5 High severity
libexpat: Out-of-bounds Read
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members c
- 9.8 Critical severity
expat: Integer Overflow or Wraparound
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).
- 9.8 Critical severity
expat: Integer Overflow or Wraparound
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).