Log in Start free

Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-117610libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

Medium 5.9

In plain English

A medium-severity null pointer dereference in libexpat from libexpat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.4%top 63.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21expat2.10.0-r0ALPINE-CVE-2026-117610
Alpine:v3.22expat2.10.0-r0ALPINE-CVE-2026-117610
Alpine:v3.23expat2.10.0-r0ALPINE-CVE-2026-117610
Alpine:v3.24expat2.10.0-r0ALPINE-CVE-2026-117610
Debian:12expatno fix listedDEBIAN-CVE-2026-117610
Debian:13expatno fix listedDEBIAN-CVE-2026-117610
Debian:14expatno fix listedDEBIAN-CVE-2026-117610
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-117610
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-117610
Ubuntu:22.04:LTSexpatno fix listedUBUNTU-CVE-2026-117610
Ubuntu:24.04:LTSexpatno fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.04:LTSexpatno fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.10expatno fix listedUBUNTU-CVE-2026-117610
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-117610
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-117610
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-117610
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-117610
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-117610
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-117610
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-117610
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-117610

Affected products (as reported)

VendorProductVersions
libexpat libexpat 0 – through 2.9.0

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References