Skip to content
OpenAdvisories
High ELSA-2026-88247 2 CVEs

Important: expat security update (Oracle Linux 9)

Published Oct 22, 2026 · Updated Oct 22, 2026

Ecosystem: Oracle Linux

Summary

[2.5.0-6.7]
- CVE-2026-102633 expat: expat: Denial of Service via integer overflow
in expat_realloc
- Resolves: RHEL-272833

[2.5.0-6.6]
- CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer
over-read in XML_ParseBuffer
- Resolves: RHEL-277510

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 expat 0:2.5.0-6.el9_8.7
Oracle Linux · 9 expat-devel 0:2.5.0-6.el9_8.7

Vulnerabilities 2

  • High 8.2
    CVE-2026-77214

    libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer

    libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, …

    libexpat project libexpat insighttoolkit4 cmake Debian Ubuntu Azure Linux Alpine
  • Medium 5.9
    CVE-2026-102633

    libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc

    libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap …

    libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine