CVE-2026-117610Medium· 5.9▾ Sunlitlibexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empt…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
libexpat <= 2.9.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118370Medium· 5.9libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
CVE-2026-115506High· 7.5libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
CVE-2026-113351Medium· 5.9libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
CVE-2026-32776Medium· 4.0libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32778Low· 2.9libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-102633Medium· 5.9libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes