Read the docs
TI-2026-69154 Aliases CVE-2026-77214GHSA-8xfx-9m5m-pgcp

Heap buffer over-read in libexpat XML_ParseBuffer

Priority MEDIUM 42CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · None · Low
Fix status
Partial Red Hat: 10 fixed, 7 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

libexpat through 2.8.5 contains a heap buffer over-read in xmlparse.c. XML_ParseBuffer advances the buffer end by a caller-supplied length without checking it against the allocated size, so repeated calls read past the heap allocation (CWE-125). A network attacker without privileges or user interaction can read adjacent heap memory through the calling application, recovering pointers that defeat ASLR.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 10 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libexpat projectlibexpatup to 2.8.5—Patch availableCNA
  • libexpat Vendorlibexpat project Affected up to 2.8.5 Fixed in — Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*——libexpat project
  • cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions — — ·libexpat project

Remediation

Upgrade libexpat to a build that includes commit 13c5f63. Red Hat fixes it in RHSA-2026:88247 (RHEL 9 AppStream and BaseOS), RHSA-2026:88248 (RHEL 10 AppStream and BaseOS), RHSA-2026:92323 (RHEL 8 BaseOS), RHSA-2026:89907 (Update Infrastructure 5), RHSA-2026:94802 (Discovery 2), RHSA-2026:95365 (Cost Management On-Premise 1), RHSA-2026:95346 (OpenShift Container Platform 4.22), and RHSA-2026:85985 and RHSA-2026:77959 (Hardened Images). Red Hat lists no fix plan for RHEL 6, 7, 8, 9 or OpenShift Container Platform 4 and 5, and lists OpenShift AI (RHOAI) as affected without a fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Red Hat 10 advisories

  • RHSA-2026:95346 Released 2026-11-06 · Red Hat rating Critical
    OpenShift Container Platform 4.22.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202611032353-0, rhcos-ppc64le-4.22.9.8.202611032353-0, rhcos-s390x-4.22.9.8.202611032353-0 +1
  • RHSA-2026:95365 Released 2026-11-04 · Red Hat rating Critical
    Red Hat Cost Management On-Premise container image update
    • Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
  • RHSA-2026:94802 Released 2026-11-04 · Red Hat rating Critical
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
Show 7 more Red Hat advisories
  • RHSA-2026:92323 Released 2026-10-30 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-6.el8_10, expat-devel-2.5.0-6.el8_10
  • RHSA-2026:89907 Released 2026-10-26 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:89758 Released 2026-10-26 · Red Hat rating Important
    firefox security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) firefox-153.5.0-1.el10_2
  • RHSA-2026:88247 Released 2026-10-22 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream (v. 9) expat-devel-2.5.0-6.el9_8.7
    • Red Hat Enterprise Linux BaseOS (v. 9) expat-2.5.0-6.el9_8.7
  • RHSA-2026:88248 Released 2026-10-22 · Red Hat rating Important
    expat security update
    • Red Hat Enterprise Linux AppStream (v. 10) expat-devel-2.7.3-1.el10_2.7
    • Red Hat Enterprise Linux BaseOS (v. 10) expat-2.7.3-1.el10_2.7
  • RHSA-2026:85985 Released 2026-10-20 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images expat-2.9.0-1.hum1@aarch64, expat-2.9.0-1.hum1@s390x, expat-2.9.0-1.hum1@src +7
  • RHSA-2026:77959 Released 2026-10-07 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images expat-2.8.5-1.2.hum1@aarch64, expat-2.8.5-1.2.hum1@s390x, expat-2.8.5-1.2.hum1@src +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat Cost Management On-Premise 1Fixed RHSA-2026:95365
Red Hat Discovery 2Fixed RHSA-2026:94802
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:88248, RHSA-2026:89758
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:88247
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:88248
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:92323
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:88247
Red Hat Hardened ImagesFixed RHSA-2026:77959, RHSA-2026:85985
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:95346
Red Hat Update Infrastructure 5Fixed RHSA-2026:89907
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-77214
  2. 2026-10-07 Alias added: GHSA-8xfx-9m5m-pgcp
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-07 CVSS score added · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:77959 · Red Hat
  6. 2026-10-09 Fix available: Red Hat Hardened Images · Red Hat
  7. 2026-10-09 Priority changed: MEDIUM → LOW
  8. 2026-10-10 CISA SSVC decision points changed
  9. 2026-10-10 Priority changed: LOW → MEDIUM
  10. 2026-10-20 Fix available: RHSA-2026:85985 · Red Hat
  11. 2026-10-21 Affected versions changed · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88247 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88248 · Red Hat
  14. 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 10) +1 · Red Hat
  15. 2026-10-29 Fix available: Red Hat Update Infrastructure 5 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:89907 · Red Hat
  17. 2026-10-30 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
  18. 2026-10-30 Fix available: RHSA-2026:92323 · Red Hat
  19. 2026-10-31 Fix available: RHSA-2026:89758 · Red Hat
  20. 2026-10-31 Affected versions changed · Red Hat
  21. 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
  22. 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat
  23. 2026-11-05 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
  24. 2026-11-06 Fix available: RHSA-2026:95365 · Red Hat
  25. 2026-11-06 Affected versions changed · Red Hat
  26. 2026-11-07 Fix available: RHSA-2026:95346 · Red Hat
  27. 2026-11-07 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat

References

Patch 1

Other 1

  • TI-2022-09008 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVSS 3.1CRITICAL 9.8
  • TI-2026-79488 Billion laughs detection delay in libexpat enables denial of service CVSS 4.0HIGH 8.7
  • TI-2022-08947 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert… CVSS 3.1CRITICAL 9.8
  • TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
  • TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
  • TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences