# libexpat.

Every CVE that names libexpat among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes](https://agentprime.io/advisories/CVE-2026-118370.md)
  `CVE-2026-118370` · CVE record: libexpat libexpat · CVSS 8.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption
- [libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser](https://agentprime.io/advisories/CVE-2026-117610.md)
  `CVE-2026-117610` · CVE record: libexpat libexpat · CVSS 8.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption
- [libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay](https://agentprime.io/advisories/CVE-2026-115506.md)
  `CVE-2026-115506` · CVE record: libexpat libexpat · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Denial of service
- [libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset](https://agentprime.io/advisories/CVE-2026-113351.md)
  `CVE-2026-113351` · CVE record: libexpat libexpat · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-909
- [libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer](https://agentprime.io/advisories/CVE-2026-77214.md)
  `CVE-2026-77214` · CVE record: libexpat libexpat · CVSS 8.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc](https://agentprime.io/advisories/CVE-2026-102633.md)
  `CVE-2026-102633` · CVE record: libexpat libexpat · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate](https://agentprime.io/advisories/CVE-2026-93990.md)
  `CVE-2026-93990` · CVE record: libexpat libexpat · CVSS 8.7 High · Not analysed yet · Published 19 Sept 2026 · Tags: CWE-176
- [Expat Out-of-Bounds Read via dtdCopy](https://agentprime.io/advisories/CVE-2026-76641.md)
  `CVE-2026-76641` · CVE record: libexpat libexpat · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption
- [Use after free in libexpat](https://agentprime.io/advisories/CVE-2026-76957.md)
  `CVE-2026-76957` · CVE record: libexpat project libexpat · CVSS 4.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Memory corruption
- [libexpat: In libexpat 2.8.2 and 2.8.3 before 2.8.4…](https://agentprime.io/advisories/CVE-2026-76956.md)
  `CVE-2026-76956` · CVE record: libexpat project libexpat · CVSS 5.9 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-394
- [Expat Denial of Service via storeAtts() Quadratic Complexity](https://agentprime.io/advisories/CVE-2026-66046.md)
  `CVE-2026-66046` · CVE record: libexpat project libexpat · CVSS 8.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Denial of service
- [Out-of-bounds read in libexpat](https://agentprime.io/advisories/CVE-2026-72522.md)
  `CVE-2026-72522` · CVE record: libexpat project libexpat · CVSS 6.2 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Memory corruption
- [Use after free in libexpat](https://agentprime.io/advisories/CVE-2026-56412.md)
  `CVE-2026-56412` · CVE record: libexpat project libexpat · CVSS 4.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56411.md)
  `CVE-2026-56411` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56410.md)
  `CVE-2026-56410` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56409.md)
  `CVE-2026-56409` · CVE record: libexpat project libexpat · CVSS 6.5 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56408.md)
  `CVE-2026-56408` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56407.md)
  `CVE-2026-56407` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56406.md)
  `CVE-2026-56406` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56405.md)
  `CVE-2026-56405` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56404.md)
  `CVE-2026-56404` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-56403.md)
  `CVE-2026-56403` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 21 Jun 2026 · Tags: Memory corruption
- [libexpat: In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c…](https://agentprime.io/advisories/CVE-2026-56132.md)
  `CVE-2026-56132` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-821
- [Use after free in libexpat](https://agentprime.io/advisories/CVE-2026-56131.md)
  `CVE-2026-56131` · CVE record: libexpat project libexpat · CVSS 4.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption
- [Use after free in libexpat](https://agentprime.io/advisories/CVE-2026-50219.md)
  `CVE-2026-50219` · CVE record: libexpat project libexpat · CVSS 4.9 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Memory corruption
- [Inefficient algorithmic complexity in libexpat](https://agentprime.io/advisories/CVE-2026-45186.md)
  `CVE-2026-45186` · CVE record: libexpat project libexpat · CVSS 2.9 Low · Not analysed yet · Published 10 May 2026 · Tags: Denial of service
- [libexpat: libexpat before 2.8.0 uses insufficient entropy…](https://agentprime.io/advisories/CVE-2026-41080.md)
  `CVE-2026-41080` · CVE record: libexpat project libexpat · CVSS 2.9 Low · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-331
- [NULL pointer dereference in libexpat](https://agentprime.io/advisories/CVE-2026-32778.md)
  `CVE-2026-32778` · CVE record: libexpat project libexpat · CVSS 2.9 Low · Not analysed yet · Published 16 Mar 2026 · Tags: Memory corruption
- [Infinite loop in libexpat](https://agentprime.io/advisories/CVE-2026-32777.md)
  `CVE-2026-32777` · CVE record: libexpat project libexpat · CVSS 4.0 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Denial of service
- [NULL pointer dereference in libexpat](https://agentprime.io/advisories/CVE-2026-32776.md)
  `CVE-2026-32776` · CVE record: libexpat project libexpat · CVSS 4.0 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: Memory corruption
- [Integer overflow in libexpat](https://agentprime.io/advisories/CVE-2026-25210.md)
  `CVE-2026-25210` · CVE record: libexpat project libexpat · CVSS 6.9 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: Memory corruption
- [NULL pointer dereference in libexpat](https://agentprime.io/advisories/CVE-2026-24515.md)
  `CVE-2026-24515` · CVE record: libexpat project libexpat · CVSS 2.9 Low · Not analysed yet · Published 23 Jan 2026 · Tags: Memory corruption
- [Inefficient algorithmic complexity in libexpat](https://agentprime.io/advisories/CVE-2025-66382.md)
  `CVE-2025-66382` · CVE record: libexpat project libexpat · CVSS 2.9 Low · Not analysed yet · Published 28 Nov 2025 · Tags: Denial of service
- [Resource allocation without limits in libexpat](https://agentprime.io/advisories/CVE-2025-59375.md)
  `CVE-2025-59375` · CVE record: libexpat project libexpat · CVSS 7.5 High · Not analysed yet · Published 15 Sept 2025 · Tags: Denial of service

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=libexpat>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/libexpat/>. Everything for agents: <https://agentprime.io/llms.txt>.