Medium severity · published Oct 28, 2026
CVE-2026-117610
libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser
New
5.9
CVSS
–
EPSS
No
On KEV
Description
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libexpat · libexpat
through 2.9.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117610
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117610
patch
https://github.com/libexpat/libexpat/pull/1444
patch
https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d
technical-description
https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510
product
https://github.com/libexpat/libexpat
third-party-advisory
https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser
More from libexpat
8.2
CVE-2026-77214
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
7.5
CVE-2026-115506
libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
7.5
CVE-2026-93990
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
7.5
CVE-2026-76641
Expat Out-of-Bounds Read via dtdCopy
5.9
CVE-2026-118370
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes