{"id":"CVE-2026-117610","kind":"vulnerability","aliases":["CVE-2026-117610"],"related":[],"title":"libexpat: crafted XML chunking crashes parser via NULL pointer dereference","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.","summary":"libexpat through 2.9.0 has a NULL pointer dereference in externalEntityInitProcessor2() when parsing external entities with empty non-final input. An attacker who controls how XML is chunked into the parser can crash the application that uses it.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"libexpat","fixed":[],"affected":"<= 2.9.0","ecosystem":"c"}],"ecosystems":[],"tags":["c","libexpat","package","perl","python","self-hosted"],"not_affected_if":["no-streaming-xml-parsing","trusted-input-only"],"how_to_check":"- Find the libexpat version: 'pkg-config --modversion expat', 'dpkg -l libexpat1', or 'rpm -q expat'; every version up to and including 2.9.0 is listed as affected.\n- Python (pyexpat), Perl XML::Parser and other bindings bundle or link libexpat: check 'python -c \"import pyexpat; print(pyexpat.EXPAT_VERSION)\"'.\n- Exposure needs the app to feed untrusted XML in chunks and to handle external entities (XML_ExternalEntityParserCreate).","fix":"No fixed libexpat release known as of 2026-10-28 (latest 2.9.0 is listed as affected). Watch https://github.com/libexpat/libexpat/blob/master/expat/Changes and distro trackers for the next release after 2.9.0.","status":"open","published_at":"2026-10-28T03:17:12+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:26+00:00","updated_at":"2026-10-28T03:33:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"libexpat: crafted XML chunking crashes parser via NULL pointer dereference","impact":"low","summary":"libexpat through 2.9.0 has a NULL pointer dereference in externalEntityInitProcessor2() when parsing external entities with empty non-final input. An attacker who controls how XML is chunked into the parser can crash the application that uses it.","category":"package","nicknames":[],"who_cares":["libexpat","c","python","perl","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker crashes the application parsing XML, causing denial of service","analyst_note":"Find the fixed libexpat version and vendor advisories; the sources give only the affected range through 2.9.0 and no patch version.","how_to_check":"- Run `xmllint --version` or check the bundled libexpat version in your application's dependency tree, and compare against `2.9.0`\n- Search your dependencies for libexpat with `ldd` or your package manager's listing (for example `dpkg -l | grep expat`)","needs_analyst":true,"not_affected_if":["trusted-input-only","no-streaming-xml-parsing"],"who_is_affected":"Applications that parse attacker-supplied XML in a streaming fashion, where the attacker controls chunk boundaries, and that process external entities through libexpat. Systems that only parse trusted, locally generated XML or that do not feed untrusted streams into expat are less exposed. The sources do not name a patched version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000613,"input_tokens":3343,"output_tokens":557,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed libexpat version and vendor advisories; the sources give only the affected range through 2.9.0 and no patch version.","search":"'-117610':13A,16A '-2026':12A,15A '2.9.0':28B,65C 'applic':60B,112C 'attack':47B,86C 'c':18B 'caus':105C 'chunk':4A,53B,90C 'contain':66C 'control':49B,88C 'craft':2A 'crash':5A,58B,110C 'cve':11A,14A 'derefer':10A,33B,70C 'empti':41B,84C,94C 'entiti':39B,103C 'extern':38B,102C 'externalentityinitprocessor2':35B,73C 'final':44B,97C 'first':98C 'forc':92C 'host':25B 'input':45B,85C 'later':107C 'lib/xmlparse.c':75C 'libexpat':1A,17A,19B,26B,63C 'mishandl':77C 'non':43B,96C 'non-fin':42B,95C 'none':81C 'null':8A,31B,68C 'packag':20B 'pars':37B,99C,108C 'parser':6A,56B 'perl':21B 'pointer':9A,32B,69C 'python':22B 'self':24B 'self-host':23B 'stream':89C 'subpars':104C 'tok':80C 'token':82C 'use':62B 'via':7A 'vulner':71C 'xml':3A,51B,79C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse attacker-supplied XML in a streaming fashion, where the attacker controls chunk boundaries, and that process external entities through libexpat. Systems that only parse trusted, locally generated XML or that do not feed untrusted streams into expat are less exposed. The sources do not name a patched version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","severity":null,"published_at":"2026-10-28T03:17:12+00:00","modified_at":"2026-10-28T03:17:12+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117610:933","url":null,"severity":null,"published_at":"2026-10-28T03:33:33+00:00","modified_at":"2026-10-28T03:33:33+00:00","first_seen_at":"2026-10-28T03:33:33+00:00","fetched_at":"2026-10-28T03:33:33+00:00","note":"No vendor advisory for this CVE found. libexpat master Changes lists 2.9.0 (2026-10-05) as latest and has no entry for it, so no fixed release is known; tracker #1160 lists several unvalidated non-public issues (PR #1444 opened 2026-10-26, unconfirmed as this one). The similar-sounding CVE-2026-32776 (fixed in 2.7.5) is a different bug. No X chatter, no PoC. Nothing verified."}],"documents":[{"id":8896,"url":"https://raw.githubusercontent.com/libexpat/libexpat/master/expat/Changes","title":"libexpat Changes (master): latest release 2.9.0, no entry for this CVE","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":8897,"url":"https://github.com/libexpat/libexpat/issues/1160","title":"libexpat #1160: Unfixed non-public security issues","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}