Red Hat Security AdvisoryRHSA-2026:64809
expat security update
Released 2026-09-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-2.el8_10.2, expat-devel-2.5.0-2.el8_10.2
Fixes 2 records
Priority LOW 31
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVSS 3.1MEDIUM 6.9· Local · No auth · No interaction · EPSS 0.00135 · Published 2026-06-19 · Partial fix · 2.8.2 CWE-821
Priority LOW 26
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
CVSS 3.1MEDIUM 5.9· Local · No auth · No interaction · EPSS 0.00181 · Published 2026-06-04 · Partial fix · 2.8.2 CWE-416
