Skip to main content

Libexpat CVE-2026-32776

| EUVDEUVD-2026-12347 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-03-16 mitre
Denial Of Service Null Pointer Dereference Libexpat Libexpat Project
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

The CVSS 3.1 score of 4.0 reflects a low-severity vulnerability: the attack vector is local (AV:L), attack complexity is low (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and impact is isolated to availability (A:L). However, real-world risk depends on deployment context. While the CVSS base score is conservative, the practical risk varies significantly: server-facing XML parsers accepting untrusted input face higher risk; offline or air-gapped systems face minimal risk. The NULL pointer dereference is reliable and non-exploitable for code execution, confirming the denial-of-service-only impact. Organizations using libexpat in high-availability services or automated processing pipelines should prioritize patching; those with manual workflows or limited XML processing can defer remediation. The lack of authentication requirements and ease of triggering via local file access warrant prompt patching in multi-tenant environments.
Exploit ScenarioDerived

An attacker with local system access creates a malicious XML file with an empty or invalid external parameter entity declaration and places it in a monitored directory (e.g., /tmp or a watched upload folder). When an automated service or user application attempts to parse this file using vulnerable libexpat, the NULL pointer dereference is triggered, causing the application to crash. In a high-availability scenario (automated XML processing, web services), repeated submission of such files causes repeated application restarts, degrading service availability. Exploitation requires local file system access (AV:L) but no special privileges, making it a viable denial-of-service vector in multi-user systems or where untrusted file uploads are processed.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

libexpat before version 2.7.5 contains a NULL pointer dereference vulnerability triggered by malformed XML containing empty external parameter entity content, resulting in denial of service through application crashes. The vulnerability affects all versions of libexpat prior to 2.7.5 across multiple platforms and applications that embed this XML parsing library. An attacker with local access can craft a malicious XML document to crash any application using vulnerable libexpat, though the impact is limited to availability (CVSS 4.0) with no code execution or data compromise possible.

RemediationAI

Upgrade libexpat to version 2.7.5 or later immediately. For system packages, use your distribution's package manager (apt upgrade libexpat1, yum update expat, etc.). For embedded copies in applications, rebuild applications linked against the patched libexpat version. If immediate patching is impossible, implement input validation at the application layer to reject XML documents with suspicious entity definitions, and restrict file system access to untrusted users to prevent local XML file creation. Monitor application logs for segmentation faults or parsing errors as indicators of exploitation attempts. Verify remediation by checking libexpat version post-patch (expat-config --version or rpm -q expat).

Affected VersionsENISA

libexpat 0 <2.7.5

Affected Packages

euvd libexpat fix: 2.7.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libexpat is a widely-used C library for parsing XML documents, commonly embedded in applications, programming language bindings (Python, Perl, Ruby), and system utilities. The vulnerability (CWE-476: NULL Pointer Dereference) occurs in the XML entity processing logic when the parser encounters an external parameter entity with empty or malformed content. Rather than gracefully handling this edge case, the parser attempts to dereference a NULL pointer, leading to an immediate segmentation fault. This is a memory safety issue in the entity expansion and validation code path that fails to perform proper bounds checking or NULL validation before dereferencing entity content pointers.

Know when Libexpat gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM
Red Hat 6.2 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
Jul 14, 2026 - 13:22 NVD
4.0 (MEDIUM) 5.5 (MEDIUM)
Patch available
Apr 16, 2026 - 05:29 EUVD
2.7.5
CVE Published
Mar 16, 2026 - 06:54 nvd
MEDIUM 4.0

DescriptionNVD

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.

Executive ViewAI

Why It Matters

Organizations using libexpat before 2.7.5 should be aware of moderate risk from CVE-2026-32776, a null pointer dereference vulnerability rated CVSS 4.0. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

EPSS Score
0.0%
Top 98% exploitable
Threat Intel
1
1 source
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in libexpat XML Parser Vulnerabilities

View all 3
CVE-2026-32777 MEDIUM
5.5
CVE-2026-32778 MEDIUM
5.5

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2026-115506 HIGH POC
8.7 Oct 22

CPU exhaustion in libexpat through 2.9.0 lets remote attackers stall XML parsing workloads by supplying a moderately siz
CVE-2026-93990 HIGH POC
8.7 Sep 19

Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high s
CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2024-28757 HIGH POC
7.5

Alpine Linux: expat fixed in 2.6.2-r0
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/ltss/sle12.5/sles12sp5:8.5.217 Affected
Container suse/manager/4.3/proxy-httpd:latest Container suse/manager/4.3/proxy-salt-broker:4.3.17.9.66.5 Container suse/manager/4.3/proxy-ssh:latest Container suse/manager/4.3/proxy-tftpd:4.3.17.9.66.5 Container suse/sle-micro/base-5.5:latest Container suse/sle-micro/kvm-5.5:latest Image SLES15-SP5-Micro-5-5 Image SLES15-SP5-Micro-5-5-Azure Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.156 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.123 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.140 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.154 Container suse/sl-micro/6.0/toolbox:13.2-9.91 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.86 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.110 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.112 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.100 Image SL-Micro Affected
Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.264 Affected
Container suse/sles/16.0/toolbox:16.3-1.42 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-155-04
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-32776 ADVISORY https://ubuntu.com/security/notices/USN-8790-1 ADVISORY https://vuldb.com/?id.351220 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1137/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1159/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1166/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1352/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20963/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20969/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20985/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21031/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21062/ REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://github.com/libexpat/libexpat/pull/1158 REF https://github.com/libexpat/libexpat/pull/1159

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy