Log in Start free

Vulnerability · Published Jan 23, 2026 · Assigned by mitre

CVE-2026-24515

Low 2.9

In plain English

A low-severity null pointer dereference in libexpat from libexpat project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.9Low
Exploit odds (30 days)0.2%top 91.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20expat2.7.4-r0ALPINE-CVE-2026-24515
Alpine:v3.21expat2.7.4-r0ALPINE-CVE-2026-24515
Alpine:v3.22expat2.7.4-r0ALPINE-CVE-2026-24515
Alpine:v3.23expat2.7.4-r0ALPINE-CVE-2026-24515
Alpine:v3.24expat2.7.4-r0ALPINE-CVE-2026-24515
Debian:12expat2.5.0-1+deb12u4DEBIAN-CVE-2026-24515
Debian:13expat2.8.2-1~deb13u1DEBIAN-CVE-2026-24515
Debian:14expat2.7.3-2DEBIAN-CVE-2026-24515
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-24515
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-24515
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-24515
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.7UBUNTU-CVE-2026-24515
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.4USN-8022-2
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.4UBUNTU-CVE-2026-24515
Ubuntu:25.10expat2.7.1-2ubuntu0.2UBUNTU-CVE-2026-24515
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-24515
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-24515
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-24515
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-24515
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-24515
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-24515
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-24515
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-24515
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-24515
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-24515
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-24515
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-24515
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-24515

Affected products (as reported)

VendorProductVersions
libexpat project libexpat 0 – before 2.7.4

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References