CVE-2026-76641

High

Description

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

SeverityHigh

CVSS7.5

Exploit probability—

ProductLibexpat

PublishedAug 20, 2026

First seenAug 20, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Patches

github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf

Affected products

Product	Affected versions	Fixed in
libexpat libexpat	v ≤ 2.8.3	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.