Log in Start free

Vulnerability · Published Aug 20, 2026 · Assigned by VulnCheck

CVE-2026-76641Expat Out-of-Bounds Read via dtdCopy

High 7.5

In plain English

A high-severity out-of-bounds read in libexpat from libexpat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 70.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21expat2.8.4-r0ALPINE-CVE-2026-76641
Alpine:v3.22expat2.8.4-r0ALPINE-CVE-2026-76641
Alpine:v3.23expat2.8.4-r0ALPINE-CVE-2026-76641
Alpine:v3.24expat2.8.4-r0ALPINE-CVE-2026-76641
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-76641
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-76641
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.9UBUNTU-CVE-2026-76641
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.9USN-8813-1
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.6UBUNTU-CVE-2026-76641
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.6USN-8813-1
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.2USN-8813-1
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.2UBUNTU-CVE-2026-76641
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-76641
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-76641
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-76641
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-76641
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-76641
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-76641
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-76641
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-76641

Affected products (as reported)

VendorProductVersions
libexpat libexpat 0 – through 2.8.3

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References