CVE-2026-76641

A flaw was found in Expat. Attackers can exploit an out-of-bounds read vulnerability by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. This can lead to memory corruption. Specifically, a mismatch in struct sizes can cause a read past memory boundaries, potentially resulting in a denial of service (DoS) due to a segfault or incorrect handling of XML attributes.

Important: An out-of-bounds read vulnerability in Expat can lead to memory corruption and denial of service when processing specially crafted XML with external entity parsers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this implement a strict "accept known good" input validation strategy that rejects any data failing to match expected specifications. Rigorously validate all length arguments, offsets, and buffer size calculations before using them to access memory boundaries. Additionally, avoid relying solely on sentinels (such as NUL characters) within untrusted input to determine array or buffer lengths. Finally, apply defense-in-depth by combining allowlists with denylists to aggressively drop outright malformed inputs before processing begins.