CVE-2026-117610: high-severity vulnerability in libexpat
libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.4%
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
libexpat · libexpatRelated CVEs — libexpat
In the same product, most dangerous first.
CVE-2026-113351HIGHlibexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserResetEPSS 0.5%CVE-2026-115506HIGHlibexpat through 2.9.0 Denial of Service via Billion Laughs Detection DelayEPSS 0.5%CVE-2026-118370HIGHlibexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixesEPSS 0.4%CVE-2026-93990HIGHExpat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked SurrogateEPSS 0.4%CVE-2026-102633HIGHlibexpat 2.7.2 through 2.8.5 Integer Overflow in expat_reallocEPSS 0.4%CVE-2026-76641HIGHExpat Out-of-Bounds Read via dtdCopyEPSS 0.4%
References
https://github.com/libexpat/libexpathttps://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489dhttps://github.com/libexpat/libexpat/pull/1444https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser