CVE-2026-76641

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.4

Description An out-of-bounds read allows attackers to trigger memory corruption when processing XML using external entity parsers created via the XML ExternalEntityParserCreate() function. A struct size mismatch between ELEMENT TYPE members causes the storeAtts() function to read the attIndex member beyond allocated memory boundaries. This leads to a failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference, which results in a segmentation fault (a crash occurring when a program attempts to access a memory location it is not allowed to access).

Recommendations Update Expat to version 2.8.4 or later. As a temporary mitigation, restrict the use of the XML ExternalEntityParserCreate() function.