CVE-2026-77214

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.9.0

Description A heap buffer over-read exists in the xmlparse.c file. The XML ParseBuffer() function advances the parse buffer end using a caller-supplied length that is not validated against the allocated buffer size. Repeated calls to XML ParseBuffer() can move the m bufferEnd variable past the end of the heap allocation, causing subsequent parsing to read out of bounds. This path is reachable if a parse buffer is already present, which occurs after a call to XML GetBuffer() or an internal allocation via XML Parse(). This issue allows the disclosure of adjacent heap memory, which can leak heap pointers, libc function pointers, and code pointers, potentially defeating Address Space Layout Randomization (ASLR), a security technique that randomly arranges the address space positions of key data areas of a process to make exploitation harder.

Recommendations Update libexpat to version 2.9.0. As a temporary mitigation, restrict the use of the XML ParseBuffer() function with attacker-influenced or oversized lengths.