libexpat CVE-2026-41080

Exploitation requires that the attacker can supply crafted XML to an application that parses it with libexpat < 2.7.6, and that the attacker can predict or enumerate sufficient candidates from the reduced salt space (4-8 bytes of entropy depending on platform unsigned long width). Applications that call XML_SetHashSalt with a low-entropy or application-controlled value are more susceptible than those relying on Expat's internal salt auto-generation, because the former further reduces the attacker's search space. The high attack complexity (AC:H in the provided CVSS vector) captures this salt-prediction requirement. No authentication is required (PR:N), but meaningful impact requires sustaining a high volume of colliding inputs - making automated bulk exploitation impractical (SSVC: not automatable). Impact is strictly limited to availability; there is no confidentiality or integrity exposure. The 'Information Disclosure' tag in the source metadata is inconsistent with the CVSS vector (C:N) and CWE-331 and should not be used to infer data leakage risk.

Converging signals place this firmly in the low-priority tier. The CVSS 3.1 score of 2.9 (Low) with AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L indicates high attack complexity and local vector with only partial availability impact. EPSS at 0.01% (2nd percentile) and SSVC exploitation=none/not-automatable reinforce that no opportunistic exploitation is occurring. The KEV listing is absent, confirming no confirmed active exploitation. One signal tension worth noting: the NVD-assigned AV:L is conservative for a library that frequently parses network-sourced XML (web feeds, SOAP, REST payloads), where AV:N would be defensible - however, AC:H limits practical exploitation regardless of vector. The impact is bounded to partial availability (A:L); there is zero confidentiality or integrity impact. The Tags field lists 'Information Disclosure,' but nothing in the CVSS vector, CWE, or source code diff supports a confidentiality impact - this tag appears to be a mislabel and should not be used for risk decisions.

An attacker with the ability to submit XML content to an application backed by libexpat < 2.7.6 constructs element or attribute names mathematically engineered to collide in Expat's internal hash table - feasible because the salt is derived from only 4-8 bytes of entropy rather than the full 16 bytes SipHash supports. Sustained submission of such crafted documents causes hash bucket chains to degrade from O(1) to O(n), slowing or hanging the XML parser and causing a service-level denial-of-service. No public exploit code has been identified at time of analysis, and the high attack complexity (salt prediction) limits opportunistic use.