Live › vulnerability › CVE-2026-117610
Go to dashboardlibexpat through 2.9.0 has a NULL pointer dereference in externalEntityInitProcessor2() when parsing external entities with empty non-final input. An attacker who controls how XML is chunked into the parser can crash the application that uses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Applications that parse attacker-supplied XML in a streaming fashion, where the attacker controls chunk boundaries, and that process external entities through libexpat. Systems that only parse trusted, locally generated XML or that do not feed untrusted streams into expat are less exposed. The sources do not name a patched version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| libexpat | c | <= 2.9.0 | – |
2.9.0 is listed as affected)2.9.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-117610")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.