CVE-2026-76641 PUBLISHED

Expat Out-of-Bounds Read via dtdCopy

Assigner: VulnCheck
Reserved: 19.08.2026 Published: 20.08.2026 Updated: 21.08.2026

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor libexpat
Product libexpat
Versions Default: affected
  • affected from 0 to 2.8.3 (incl.)

Credits

  • ZeyouLiu (@liuzeyouzeyou) finder
  • ZeyouLiu (@liuzeyouzeyou) remediation developer

References

Problem Types

  • Out-of-bounds Read CWE