XML Parsing Flaw in libexpat Affects Users
CVE-2026-24515

2.9LOW

Key Information:

Vendor

Libexpat Project

Status
Libexpat
Vendor
CVE Published:
23 January 2026

What is CVE-2026-24515?

A vulnerability in libexpat, an XML parsing library, was discovered where the XML_ExternalEntityParserCreate function fails to properly copy user data associated with unknown encoding handlers. This oversight can lead to potential security exploitation, as attackers may leverage this flaw to manipulate XML processing behavior and impact system integrity.

Affected Version(s)

libexpat 0 < 2.7.4

References

https://github.com/libexpat/libexpat/pull/1131

CVSS V3.1

Score:
2.9
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.