DeutschShown in its original language — a full translation is planned for a future version.
libexpat: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
view advisory published 2026-06-21
Ein lokaler Angreifer kann mehrere Schwachstellen in libexpat ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Manipulation von Daten, die Umgehung von Sicherheitsmaßnahmen, die Offenlegung vertraulicher Informationen oder die Herbeiführung eines Denial-of-Service-Zustands.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-56412US | medium5.9 | — | ||
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy… | ||||
| CVE-2026-56411US | — | — | ||
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | ||||
| CVE-2026-56410US | — | — | ||
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | ||||
| CVE-2026-56409US | — | — | ||
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | ||||
| CVE-2026-56408US | — | — | ||
libexpat before 2.8.2 has an integer overflow in copyString. | ||||
| CVE-2026-56407US | — | — | ||
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | ||||
| CVE-2026-56406US | — | — | ||
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | ||||
| CVE-2026-56405US | medium6.9 | — | ||
libexpat before 2.8.2 has an integer overflow in getAttributeId. | ||||
| CVE-2026-56404US | medium6.9 | — | ||
libexpat before 2.8.2 has an integer overflow in addBinding. | ||||
| CVE-2026-56403US | medium6.9 | — | ||
libexpat before 2.8.2 has an integer overflow in storeAtts. | ||||
| CVE-2026-50219US | medium5.9 | — | ||
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of… | ||||
02
references
External citations — patches, advisories, analysis.
- Meinberg Security Advisory MBGSA-2026.05 vom 2026-07-21external
- OpenBSD 7.8 Errata vom 2026-08-22external
- Red Hat Security Advisory RHSA-2026:30647 vom 2026-06-28external
- Red Hat Security Advisory RHSA-2026:64809 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:64810 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:64812 vom 2026-09-08external
- Red Hat Security Advisory RHSA-2026:79357 vom 2026-10-08external
- IBM Security Bulletin 7287454 vom 2026-09-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan