Red Hat Security AdvisoryRHSA-2026:64812
expat security update
Released 2026-09-08 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) expat-devel-2.5.0-6.el9_8.3
- Red Hat Enterprise Linux BaseOS (v. 9) expat-2.5.0-6.el9_8.3
Fixes 2 records
Priority LOW 31
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVSS 3.1MEDIUM 6.9· Local · No auth · No interaction · EPSS 0.00135 · Published 2026-06-19 · Partial fix · 2.8.2 CWE-821
Priority LOW 26
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
CVSS 3.1MEDIUM 5.9· Local · No auth · No interaction · EPSS 0.00181 · Published 2026-06-04 · Partial fix · 2.8.2 CWE-416
