CVE catalog

CVE-2026-102633

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to ap

[CVE catalog]

Severity
High · CVSS 8.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 22, 2026

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexpatsid2.9.0-1fixed
Debianexpatforky2.9.0-1fixed
Debianexpattrixie2.8.3-1~deb13u1vulnerable
Debianexpattrixie-security2.9.0-1~deb13u1fixed
Debianexpatbookworm2.5.0-1+deb12u2vulnerable
Debianexpatbookworm-security2.5.0-1+deb12u5fixed
Opensuseexpattumbleweed2.8.5-1.1fixed
Alpineexpat3.212.9.0-r0fixed
Alpineexpat3.222.9.0-r0fixed
Alpineexpat3.232.9.0-r0fixed
Alpineexpat3.242.9.0-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexpatsourcesid2.8.5-2not yet assignedNot reported[1149507]
Debianexpatsourceforky2.8.5-2not yet assignedNot reported[1149507]
Debianexpatsourcetrixie2.9.0-1~deb13u1not yet assignedNot reported[1149507]
Debianexpatsourcebookworm2.5.0-1+deb12u5not yet assignedNot reported[1149507]
Opensuseexpatrpmtumbleweed2.8.5-1.1Not reportedOPENSUSE-SU-2026:11981-1Not reported
Alpineexpatapk3.212.9.0-r0Not reportedALPINE-CVE-2026-102633Not reported
Alpineexpatapk3.222.9.0-r0Not reportedALPINE-CVE-2026-102633Not reported
Alpineexpatapk3.232.9.0-r0Not reportedALPINE-CVE-2026-102633Not reported
Alpineexpatapk3.242.9.0-r0Not reportedALPINE-CVE-2026-102633Not reported

[Debian bug #1149507]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [expat]Affected
    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

  • [libexpat1]Affected

    Source package: [expat]

    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

  • [libexpat1-dev]Affected

    Source package: [expat]

    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      nvd · expat · debian · bookworm; nvd · expat · debian · 12

[Debian 13 (Trixie)]

  • [expat]Affected
    Details (6)

    • 2.7.1-2 · amd64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

  • [libexpat1]Affected

    Source package: [expat]

    Details (6)

    • 2.7.1-2 · amd64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

  • [libexpat1-dev]Affected

    Source package: [expat]

    Details (6)

    • 2.7.1-2 · amd64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Affected · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.0-1~deb13u1

      nvd · expat · debian · 13

[openSUSE Tumbleweed]

  • [expat]Affected

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 2.8.5-1.1

      nvd · expat · opensuse · tumbleweed

  • [libexpat1]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.8.5-1.1

      Version impact unknown

      nvd · expat · opensuse · tumbleweed

  • [libexpat1-32bit]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.8.5-1.1

      Version impact unknown

      nvd · expat · opensuse · tumbleweed

  • [libexpat-devel]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.8.5-1.1

      Version impact unknown

      nvd · expat · opensuse · tumbleweed

  • [libexpat-devel-32bit]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.8.5-1.1

      Version impact unknown

      nvd · expat · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]