libexpat CVE-2026-76641

Exploitation requires three concurrent conditions: (1) the target application links libexpat in an affected version (≤2.8.3 incorporating the CVE-2026-66046 fix); (2) the application accepts attacker-supplied XML input without sanitizing or rejecting external entity references; and (3) external entity resolution is active - the application must call XML_ExternalEntityParserCreate() in response to an external entity declaration in the DTD. The CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms no authentication or special attack conditions are required beyond delivering the malformed XML payload over the network. Applications that disable external entity processing (a recommended security hardening step) are fully immune. Services that parse only internal or schema-validated XML with no user-controlled content are not practically exploitable. The regression origin of this flaw means applications running a libexpat version predating the CVE-2026-66046 fix are unaffected by this specific code path, though they may carry the original CVE-2026-66046 flaw instead.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects a network-reachable, unauthenticated, low-complexity path to a high-availability impact. The primary risk multiplier is libexpat's broad embedding - crashes propagate to any application in the call stack using the library. The availability impact is clear (segfault), while the 'Information Disclosure' tag in the intelligence data suggests the OOB read may also expose adjacent heap memory contents, though this secondary vector is not confirmed by the CVSS vector (VC:N/VI:N). The CVSS 4.0 vector shows no confidentiality or integrity impact at the vulnerable-system level, aligning with the description's primary outcome of a crash; the whitespace normalization failure represents a functional correctness issue rather than a security boundary violation. No KEV listing and no confirmed POC reduce immediate exploitation pressure, but the straightforward trigger mechanism - a crafted XML document with external entities - requires no special tooling, lowering the practical barrier for exploitation. Applications that have disabled external entity resolution are fully protected. The regression nature of this flaw (introduced by the CVE-2026-66046 fix) means that only versions incorporating that prior fix are affected within the ≤2.8.3 window, though EUVD conservatively lists all versions through 2.8.3 as affected.

An attacker submits a crafted XML document containing an external entity declaration pointing to an attacker-controlled or arbitrary URI to a web service, document processor, or API endpoint that uses libexpat for parsing. The application calls XML_ExternalEntityParserCreate() to resolve the entity, triggering dtdCopy() to copy the DTD with undersized hash-table entries; storeAtts() subsequently reads the attIndex field beyond the allocated buffer boundary, causing a wild pointer dereference and segfault that crashes the hosting process. Repeated submissions achieve persistent denial of service against the target service.