CVE-2026-76641
Received Received - Intake

Expat XML Parser Out-of-Bounds Read Vulnerability

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76641
EUVD
EUVD-2026-63493

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
expat expat to 2.8.3 (exc)
libexpat libexpat to 2.8.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76641 is an out-of-bounds read vulnerability in Expat versions 2.8.3 and earlier. It occurs due to a struct size mismatch in the ELEMENT_TYPE members, causing the storeAtts function to read past allocated memory when processing XML with external entity parsers. This can lead to memory corruption, whitespace normalization failures, or segmentation faults.

Detection Guidance

Detecting this vulnerability requires checking the version of libexpat installed on your system. Run 'expat --version' or 'dpkg -l | grep expat' on Debian-based systems or 'rpm -qa | grep expat' on RPM-based systems to verify if an affected version (2.8.3 or earlier) is present.

Impact Analysis

This vulnerability can cause crashes or unexpected behavior in applications using affected Expat versions. Attackers could exploit it to trigger memory corruption or denial-of-service conditions by processing specially crafted XML input.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a memory corruption issue in the Expat XML parser that could lead to crashes or incorrect behavior when processing XML with external entity parsers. Compliance impacts would depend on how the affected software is used in systems handling regulated data.

Mitigation Strategies

Immediately update libexpat to the latest patched version. If using a package manager, run 'apt-get update && apt-get upgrade expat' or 'yum update expat'. If compiling from source, pull the latest changes from the libexpat repository and rebuild.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76641. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart