libexpat: Heap buffer over-read in XML_ParseBuffer
Summary
libexpat, a streaming XML parser embedded in many applications and distributions, contains a heap buffer over-read in XML_ParseBuffer. The function advances the parse buffer end by a caller-supplied length without checking it against the allocated buffer size, so repeated calls can read past the heap allocation. A remote attacker who can influence the input processed by an affected application may be able to read adjacent heap memory, such as pointers that help defeat ASLR. Upstream maintainers consider the length the caller's responsibility, so real exposure depends on how each application calls the API.
Affected
- libexpat up to and including 2.8.5 (per VulnCheck)
- Some sources state 'prior to 2.9.0'; treat all versions before 2.9.0 as potentially affected until your distribution confirms otherwise
Fixed in
- Upstream fix: commit 13c5f63 (PR #1393)
- Upstream release: Expat 2.9.0 (released 2026-10-05; confirm CVE-2026-77214 in the changelog)
- Use the fixed package version from your Linux distribution, not only the upstream version number
Workaround
Unknown.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact partial
- No in-the-wild exploitation or public exploit known at the time of research
- EPSS about 0.003 (low)
Our recommendation
- Identify systems and container images that bundle or link libexpat, including via Python, PHP, Perl or other runtimes
- Update libexpat to the fixed version from your distribution and restart dependent services or rebuild images
- Rescan images after updating, because some scanners may still report 'no fix available' from older snapshots
- Prioritise internet-facing services that parse untrusted XML
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream fix commit 13c5f63 github.com
- Upstream pull request #1393 github.com
- VulnCheck advisory www.vulncheck.com
- Debian security tracker CVE-2026-77214 security-tracker.debian.org
- Expat project news libexpat.github.io
- Red Hat advisory RHSA-2026:89758 (via Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:00.
Original description (NVD)
libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.