CVE-2026-76641

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf
https://github.com/libexpat/libexpat/pull/1331
https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy

Configurations

No configuration.

History

26 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Expat hasta la versión 2.8.3 contiene una vulnerabilidad de lectura fuera de límites que permite a los atacantes provocar corrupción de memoria al procesar XML con analizadores de entidades externas creados mediante XML_ExternalEntityParserCreate. Una falta de coincidencia en el tamaño de la estructura entre los miembros de ELEMENT_TYPE hace que storeAtts lea el miembro attIndex más allá de los límites de memoria asignada, lo que resulta en una falla al normalizar los espacios en blanco en atributos que no son CDATA o una desreferencia de puntero errante que causa un fallo de segmentación. Esta vulnerabilidad fue introducida por la corrección para CVE-2026-66046.

Information

Published : 2026-08-20 18:16

Updated : 2026-10-26 10:10

NVD link : CVE-2026-76641

Mitre link : CVE-2026-76641

CVE.ORG link : CVE-2026-76641

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-76641", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76641", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T18:48:51.305928Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/libexpat/libexpat", "vendor": "libexpat", "product": "libexpat", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.8.3"}], "packageURL": "pkg:github/libexpat/libexpat", "defaultStatus": "affected"}]}], "published": "2026-08-20T18:16:51.887", "references": [{"url": "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/libexpat/libexpat/pull/1331", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046."}, {"lang": "es", "value": "Expat hasta la versi\u00f3n 2.8.3 contiene una vulnerabilidad de lectura fuera de l\u00edmites que permite a los atacantes provocar corrupci\u00f3n de memoria al procesar XML con analizadores de entidades externas creados mediante XML_ExternalEntityParserCreate. Una falta de coincidencia en el tama\u00f1o de la estructura entre los miembros de ELEMENT_TYPE hace que storeAtts lea el miembro attIndex m\u00e1s all\u00e1 de los l\u00edmites de memoria asignada, lo que resulta en una falla al normalizar los espacios en blanco en atributos que no son CDATA o una desreferencia de puntero errante que causa un fallo de segmentaci\u00f3n. Esta vulnerabilidad fue introducida por la correcci\u00f3n para CVE-2026-66046."}], "lastModified": "2026-10-26T10:10:00.140", "sourceIdentifier": "disclosure@vulncheck.com"}