NULL Pointer Dereference Vulnerability in libexpat XML Parser
CVE-2026-117610

8.2HIGH

Key Information:

Vendor

Libexpat

Status
Libexpat
Vendor
CVE Published:
28 October 2026

What is CVE-2026-117610?

The libexpat XML parsing library, specifically versions up to 2.9.0, is susceptible to a NULL pointer dereference. This vulnerability occurs in the externalEntityInitProcessor2() function within xmlparse.c, triggered by mishandling the XML_TOK_NONE token from empty input. By controlling stream chunking, an attacker can induce an empty first parse on an external entity subparser, potentially leading to crashes during subsequent parsing attempts.

Affected Version(s)

libexpat 0 <= 2.9.0

References

https://github.com/libexpat/libexpat/pull/1444
patchissue-tracking
https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16...
patch
https://github.com/libexpat/libexpat/blob/a76b1174c1ea52a...
technical-description

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Minkyung Park
Sebastian Pipping
.