CVE-2026-24515

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.7.4

Description The issue resides in the XML ExternalEntityParserCreate function. It does not properly copy user data for unknown encoding handlers, potentially leading to memory corruption. Reports indicate a critical impact on Linux distributions and applications, with the possibility of Remote Code Execution (RCE). The issue is described as an XML External Entity (XXE) flaw.

Recommendations Versions prior to 2.7.4 should be updated to version 2.7.4 or later.