Most recent entries from all

BELL-CVE-2026-56403

Affected: Alpaquita:23: expat, Alpaquita:25: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:25: expat, BellSoft Hardened Containers:stream: expat

EUVD-2026-329005

fkie_cve-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts.

GHSA-xqw9-f65g-5qxw

libexpat before 2.8.2 has an integer overflow in storeAtts.

msrc_CVE-2026-56403 — libexpat before 2.8.2 has an integer overflow in storeAtts.

msrc_CVE-2026-56403

OESA-2026-2973 — expat security update

Affected: openEuler:20.03-LTS-SP4: expat

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fix(es):

libexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)

libexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)

libexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)

libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)

libexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)

openSUSE-SU-2026:11584-1 — expat-2.8.2-1.1 on GA media

expat-2.8.2-1.1 on GA media

SUSE-SU-2026:23894-1 — Security update for expat

Security update for expat

UBUNTU-CVE-2026-56403

Affected: Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 64 more

libexpat before 2.8.2 has an integer overflow in storeAtts.

WID-SEC-W-2026-2025 — libexpat: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein lokaler Angreifer kann mehrere Schwachstellen in libexpat ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Manipulation von Daten, die Umgehung von Sicherheitsmaßnahmen, die Offenlegung vertraulicher Informationen oder die Herbeiführung eines Denial-of-Service-Zustands.