CVE catalog

CVE-2026-77214

expat: CVE-2026-77214

[CVE catalog]

Severity
High · CVSS 8.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 22, 2026

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexpatsid2.9.0-1fixed
Debianexpatforky2.9.0-1fixed
Debianexpattrixie2.8.3-1~deb13u1vulnerable
Debianexpattrixie-security2.9.0-1~deb13u1fixed
Debianexpatbookworm2.5.0-1+deb12u2vulnerable
Debianexpatbookworm-security2.5.0-1+deb12u5fixed
Opensuseexpattumbleweed2.9.0-1.1fixed
Alpineexpat3.212.9.0-r0fixed
Alpineexpat3.222.9.0-r0fixed
Alpineexpat3.232.9.0-r0fixed
Alpineexpat3.242.9.0-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexpatsourcesid2.9.0-1not yet assignedNot reported[1150320]
Debianexpatsourceforky2.9.0-1not yet assignedNot reported[1150320]
Debianexpatsourcetrixie2.9.0-1~deb13u1not yet assignedNot reported[1150320]
Debianexpatsourcebookworm2.5.0-1+deb12u5not yet assignedNot reported[1150320]
Opensuseexpatrpmtumbleweed2.9.0-1.1Not reportedOPENSUSE-SU-2026:12100-1Not reported
Alpineexpatapk3.212.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported
Alpineexpatapk3.222.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported
Alpineexpatapk3.232.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported
Alpineexpatapk3.242.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported

[Debian bug #1150320]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [expat]Affected
    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • [libexpat1]Affected

    Source package: [expat]

    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • [libexpat1-dev]Affected

    Source package: [expat]

    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Affected · Fixed: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

[Debian 13 (Trixie)]

  • [expat]Affected
    Details (6)

    • 2.7.1-2 · amd64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

  • [libexpat1]Affected

    Source package: [expat]

    Details (6)

    • 2.7.1-2 · amd64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

  • [libexpat1-dev]Affected

    Source package: [expat]

    Details (6)

    • 2.7.1-2 · amd64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Affected · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

[openSUSE Tumbleweed]

  • [expat]Affected

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Affected · Fixed: 2.9.0-1.1

      dsa · expat · opensuse · tumbleweed

  • [libexpat1]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

  • [libexpat1-32bit]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

  • [libexpat-devel]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

  • [libexpat-devel-32bit]Unknown

    Source package: [expat]

    Details (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]