Libexpat vulnerabilities
11 known vulnerabilities in Libexpat from Libexpat Project. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
libexpat: Use After Free
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
- 7.5 High severity
libexpat: Unexpected Status Code or Return Value
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
- 7.5 High severity
libexpat: Inefficient Algorithmic Complexity
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementTyp
- 7.5 High severity
libexpat: Inefficient Algorithmic Complexity
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
- 7.8 High severity
libexpat: Integer Overflow or Wraparound
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
- 9.8 Critical severity
expat: Integer Overflow or Wraparound
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).
- 9.8 Critical severity
expat: Integer Overflow or Wraparound
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP…: Improper Restriction of Recursive Entity References in DTDs
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
- 7.5 High severity
libexpat: Uncontrolled Resource Consumption
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Use After Free
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Improper Encoding or Escaping of Output
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.