Vulnerabilities in libexpat project
26 resultsVexday analysis
O libexpat registra 22 vulnerabilidades totais, com preocupação significativa: 14 publicadas nos últimos 90 dias indicam descobertas ativas e recentes. Embora nenhuma esteja sob exploração confirmada (KEV) e nenhuma seja crítica em CVSS, a fraqueza dominante em overflow de inteiros (CWE-190) representa risco de negação de serviço e potencial corrupção de memória em aplicações que dependem da biblioteca. A velocidade de descobertas recomenda revisão de atualizações do projeto.
CVE-2025-59375HIGHlibexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsiEPSS 1.3%CVE-2026-66046HIGHExpat Denial of Service via storeAtts() Quadratic ComplexityEPSS 0.7%CVE-2026-45186LOWIn libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crEPSS 0.6%CVE-2026-76956MEDIUMIn libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in beinEPSS 0.5%CVE-2026-41080LOWlibexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.EPSS 0.4%CVE-2025-66382LOWIn libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.EPSS 0.2%CVE-2026-25210MEDIUMIn libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow chEPSS 0.2%CVE-2026-24515LOWIn libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.EPSS 0.2%CVE-2026-72522MEDIUMlibexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates dEPSS 0.2%CVE-2026-32777MEDIUMlibexpat before 2.7.5 allows an infinite loop while parsing DTD content.EPSS 0.2%CVE-2026-32776MEDIUMlibexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.EPSS 0.2%CVE-2026-32778LOWlibexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.EPSS 0.2%CVE-2026-76957MEDIUMlibexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is simiEPSS 0.1%CVE-2026-56403MEDIUMlibexpat before 2.8.2 has an integer overflow in storeAtts.EPSS 0.1%CVE-2026-56408MEDIUMlibexpat before 2.8.2 has an integer overflow in copyString.EPSS 0.1%CVE-2026-56405MEDIUMlibexpat before 2.8.2 has an integer overflow in getAttributeId.EPSS 0.1%CVE-2026-56404MEDIUMlibexpat before 2.8.2 has an integer overflow in addBinding.EPSS 0.1%CVE-2026-56406MEDIUMlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.EPSS 0.1%CVE-2026-56411MEDIUMxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.EPSS 0.1%CVE-2026-56407MEDIUMlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.EPSS 0.1%