NULL Pointer Dereference Vulnerability in Libexpat Affects Multiple Versions
CVE-2026-32776

4MEDIUM

Key Information:

Vendor: Libexpat Project
Status: Libexpat
Vendor: CVE Published:; 16 March 2026

🔔 Create Libexpat Project Vulnerability Alert

What is CVE-2026-32776?

A vulnerability exists in libexpat prior to version 2.7.5, which allows for a NULL pointer dereference when handling empty external parameter entity content. This flaw could lead to instability or crashes in applications utilizing the affected library, thus potentially disrupting services and impacting overall application performance. Users and developers are urged to update to the latest version to mitigate this issue.

Affected Version(s)

libexpat 0 < 2.7.5

References

https://github.com/libexpat/libexpat/pull/1158

https://github.com/libexpat/libexpat/pull/1159

CVSS V3.1

Score:

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 16, 2026
Vulnerability Reserved
Mar 16, 2026

CVE-2026-32776 Data

JSON