Out-of-Bounds Read Vulnerability in Expat by Libexpat

CVE-2026-76641

What is CVE-2026-76641?

An out-of-bounds read vulnerability exists in the Expat XML parser, specifically through versions up to 2.8.3. This vulnerability arises from memory corruption issues when processing XML with external entity parsers created via XML_ExternalEntityParserCreate. The problem is rooted in a struct size mismatch within ELEMENT_TYPE members, which leads to the storeAtts function reading the attIndex member beyond the allocated memory boundaries. Such an exploitation results in a failure to normalize whitespace in non-CDATA attributes and can cause wild pointer dereferences, leading to potential segmentation faults. This vulnerability stems from a fix previously implemented to address a different issue.

References