Known Vulnerabilities for products from Libexpat Project
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Libexpat Project".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-118370 json | libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attacker... | Not Provided | 2026-10-28 | 2026-11-02 |
| CVE-2026-117610 json | libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c ... | Not Provided | 2026-10-28 | 2026-11-05 |
| CVE-2026-115506 json | libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerate... | Not Provided | 2026-10-22 | 2026-11-02 |
| CVE-2026-113351 json | libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count ... | Not Provided | 2026-10-20 | 2026-11-03 |
| CVE-2026-76957 json | libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOT... | Not Provided | 2026-08-20 | 2026-11-10 |
| CVE-2026-76956 json | In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which ... | Not Provided | 2026-08-20 | 2026-09-08 |
| CVE-2026-66046 json | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() ... | Not Provided | 2026-08-18 | 2026-11-10 |
| CVE-2026-56412 json | libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for v... | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56411 json | xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56410 json | xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56409 json | xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56408 json | libexpat before 2.8.2 has an integer overflow in copyString. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56407 json | libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56406 json | libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56405 json | libexpat before 2.8.2 has an integer overflow in getAttributeId. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56404 json | libexpat before 2.8.2 has an integer overflow in addBinding. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56403 json | libexpat before 2.8.2 has an integer overflow in storeAtts. | Not Provided | 2026-06-21 | 2026-11-10 |
| CVE-2026-56132 json | In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array real... | Not Provided | 2026-06-19 | 2026-11-10 |
| CVE-2026-56131 json | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a poli... | Not Provided | 2026-06-19 | 2026-11-10 |
| CVE-2026-50219 json | libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFre... | Not Provided | 2026-06-04 | 2026-11-10 |
Known software with vulnerabilities from Libexpat Project
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Libexpat Project | Libexpat | - |