Summary
It was discovered that Expat did not correctly handle certain integer
arithmetic. An attacker could possibly use this issue to cause a denial of
service.
(CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)
It was discovered that Expat did not correctly track handler call depth. An
attacker could possibly use this issue to cause Expat to crash or execute
arbitrary code. (CVE-2026-56131)
It was discovered that Expat did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause Expat to
crash or execute arbitrary code. (CVE-2026-56132)
It was discovered that Expat did not correctly handle certain Unicode
characters. An attacker could possibly use this issue to cause Expat to use
excessive resources, leading to a denial of service. (CVE-2026-72522)
It was discovered that Expat did not correctly process certain XML
attributes. A remote attacker could possibly use this issue to cause Expat
to use excessive resources, leading to a denial of service.
(CVE-2026-66046)
It was discovered that Expat did not correctly handle certain external
entities. An attacker could possibly use this issue to cause Expat to crash
or execute arbitrary code. (CVE-2026-76641)
It was discovered that Expat did not correctly track handler call depth
with custom encodings. An attacker could possibly use this issue to cause
Expat to crash or execute arbitrary code. (CVE-2026-76957)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | expat | 2.4.7-1ubuntu0.9 |
| Ubuntu · 24.04 LTS 24.04:LTS | expat | 2.6.1-2ubuntu0.6 |
| Ubuntu · 26.04 LTS 26.04:LTS | expat | 2.7.4-1ubuntu0.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | expat | 2.1.0-4ubuntu1.4+esm13 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | expat | 2.1.0-7ubuntu0.16.04.5+esm14 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | expat | 2.2.5-3ubuntu0.9+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | expat | 2.2.9-1ubuntu0.8+esm3 |
Vulnerabilities 11
-
High 7.5
Expat Denial of Service via storeAtts() Quadratic Complexity
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementTy…
-
High 7.5
Expat Out-of-Bounds Read via dtdCopy
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members …
-
Medium 6.9
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing arra…
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Pars…
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
-
Medium 6.9
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
-
Medium 6.9
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
-
Medium 6.5
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
-
Medium 6.2
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same…
-
Medium 4.9
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of …
-
Medium 4.9
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occu…
References
-
report
https://ubuntu.com/security/CVE-2026-56131
-
report
https://ubuntu.com/security/CVE-2026-56132
-
report
https://ubuntu.com/security/CVE-2026-56406
-
report
https://ubuntu.com/security/CVE-2026-56407
-
report
https://ubuntu.com/security/CVE-2026-56409
-
report
https://ubuntu.com/security/CVE-2026-56410
-
report
https://ubuntu.com/security/CVE-2026-56411
-
report
https://ubuntu.com/security/CVE-2026-66046
-
report
https://ubuntu.com/security/CVE-2026-72522
-
report
https://ubuntu.com/security/CVE-2026-76641
-
report
https://ubuntu.com/security/CVE-2026-76957