Catalogo CVE

CVE-2026-77214

expat: CVE-2026-77214

[Catalogo CVE]

Gravità
High · CVSS 8.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 22, 2026

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexpatsid2.9.0-1fixed
Debianexpatforky2.9.0-1fixed
Debianexpattrixie2.8.3-1~deb13u1vulnerable
Debianexpattrixie-security2.9.0-1~deb13u1fixed
Debianexpatbookworm2.5.0-1+deb12u2vulnerable
Debianexpatbookworm-security2.5.0-1+deb12u5fixed
Opensuseexpattumbleweed2.9.0-1.1fixed
Alpineexpat3.212.9.0-r0fixed
Alpineexpat3.222.9.0-r0fixed
Alpineexpat3.232.9.0-r0fixed
Alpineexpat3.242.9.0-r0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexpatsourcesid2.9.0-1not yet assignedNot reported[1150320]
Debianexpatsourceforky2.9.0-1not yet assignedNot reported[1150320]
Debianexpatsourcetrixie2.9.0-1~deb13u1not yet assignedNot reported[1150320]
Debianexpatsourcebookworm2.5.0-1+deb12u5not yet assignedNot reported[1150320]
Opensuseexpatrpmtumbleweed2.9.0-1.1Not reportedOPENSUSE-SU-2026:12100-1Not reported
Alpineexpatapk3.212.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported
Alpineexpatapk3.222.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported
Alpineexpatapk3.232.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported
Alpineexpatapk3.242.9.0-r0Not reportedALPINE-CVE-2026-77214Not reported

[Debian bug #1150320]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [expat]Interessata
    Dettagli (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • [libexpat1]Interessata

    Pacchetto sorgente: [expat]

    Dettagli (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • [libexpat1-dev]Interessata

    Pacchetto sorgente: [expat]

    Dettagli (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Interessata · Corretta: 2.5.0-1+deb12u5

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

[Debian 13 (Trixie)]

  • [expat]Interessata
    Dettagli (6)

    • 2.7.1-2 · amd64 · trixie

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Corretta · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

  • [libexpat1]Interessata

    Pacchetto sorgente: [expat]

    Dettagli (6)

    • 2.7.1-2 · amd64 · trixie

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Corretta · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

  • [libexpat1-dev]Interessata

    Pacchetto sorgente: [expat]

    Dettagli (6)

    • 2.7.1-2 · amd64 · trixie

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Interessata · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Corretta · Corretta: 2.9.0-1~deb13u1

      dsa · expat · debian · 13

[openSUSE Tumbleweed]

  • [expat]Interessata

    Pacchetto sorgente: [expat]

    Dettagli (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Interessata · Corretta: 2.9.0-1.1

      dsa · expat · opensuse · tumbleweed

  • [libexpat1]Sconosciuto

    Pacchetto sorgente: [expat]

    Dettagli (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

  • [libexpat1-32bit]Sconosciuto

    Pacchetto sorgente: [expat]

    Dettagli (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

  • [libexpat-devel]Sconosciuto

    Pacchetto sorgente: [expat]

    Dettagli (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

  • [libexpat-devel-32bit]Sconosciuto

    Pacchetto sorgente: [expat]

    Dettagli (1)

    • 2.8.2-1.1 · x86_64 · tumbleweed

      Sconosciuto · Corretta: 2.9.0-1.1

      Version impact unknown

      dsa · expat · opensuse · tumbleweed

Osservato:

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]