libexpat: NULL pointer dereference in external entity subparser
Summary
libexpat through version 2.9.0 contains a NULL pointer dereference in externalEntityInitProcessor2() that mishandles an empty non-final first parse on an external entity subparser. An attacker who controls how XML input is split into chunks can cause a later parse to crash the application. The impact is a denial of service; no confidentiality or integrity impact is described.
Affected
- libexpat 0 to 2.9.0 (inclusive)
- Applications that embed libexpat and parse attacker-supplied XML with external entity handling
- Debian 13 libexpat1 2.9.0-1~deb13u1 (secondary report, not verified)
Fixed in
Unknown. The fixed release has not been confirmed; check commit 7b0d50e4b1d16fafd55876260701e04279a7489d, PR #1444 and the project release notes.
Workaround
- No vendor-specified workaround found.
- Disable external entity resolution in applications where the XML settings allow it.
- Reject or size-limit untrusted XML before it reaches the parser.
Exploitation
- Not known to be exploited in the wild; not listed in KEV according to Strix.
- No public proof of concept found. VulDB assesses exploitation as easy, which is not evidence of exploitation.
Our recommendation
- Identify applications that embed libexpat and parse untrusted XML, such as web services, SOAP/XML APIs and document importers.
- Check your distribution's security tracker for a patch and apply it as soon as it is available.
- Disable external entity handling or limit XML input where possible.
- Ensure crashed services restart automatically and monitor for repeated crashes.
- Note that CVSS scores differ: VulnCheck gives 8.2, Strix and OpenCVE give 5.9. NVD analysis was pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- libexpat fix commit github.com
- libexpat pull request 1444 github.com
- Ubuntu security CVE-2026-117610 ubuntu.com
- libexpat news libexpat.github.io
- VulDB CVE entry vuldb.com
- Strix CVE entry www.strix.ai
- Debian expat tracker tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:48.
Original description (NVD)
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
NVD references (5)
- https://github.com/libexpat/libexpat
- https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468…
- https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d
- https://github.com/libexpat/libexpat/pull/1444
- https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subp…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.