CVE-2026-124317 · Package
NO FIX YET
libexpat through 2.10.0 reads past its parse buffer in unknown_toUtf8() and unknown_toUtf16() when an application-registered unknown encoding receives a truncated multibyte sequence. An attacker who supplies such a document can leak adjacent memory or crash the application.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that parse untrusted XML and register their own unknown-encoding handlers with libexpat are the exposed case described in the sources. Programs that use only the built-in encodings are not described as affected. The sources do not say which fixed version to move to.
Not affected if built-in-encodings-only, default-config
Who cares c, libexpat, xml-parsing
pkg-config --modversion expat on Linux or the bundled version in your dependency tree.No fix yet, per the sources.
libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.