libexpat EUVD-2026-111545

Exploitation requires the target application to parse attacker-influenced XML that triggers an external entity reference and to create an external-entity subparser via XML_ExternalEntityParserCreate (i.e., an external-entity-ref handler is in use). The attacker must also control stream chunking so that the subparser's first parse is an empty, non-final buffer (XML_TOK_NONE, isFinal=XML_FALSE), which is the precise precondition the CVSS 4.0 AT:P flag reflects. Limiting factors: the application must use external-entity subparsing (not universal), the attacker must be able to influence how input is split across XML_Parse calls, and the maximum impact is a crash (availability only) - no code execution or data disclosure. Affected: libexpat through 2.9.0; the fix is available via vendor PR #1444 / commit 7b0d50e4.

This is a denial-of-service NULL pointer dereference (CWE-476) in libexpat, confirmed and detailed by the vendor's own patch (PR #1444, commit 7b0d50e4) and a VulnCheck advisory, so the mechanism is well-established rather than speculative. The only supplied score is CVSS 4.0 (8.2, computed with VA:H but VC:N/VI:N) - impact is strictly availability, meaning a crash of the parsing application, with no confidentiality or integrity loss. The 8.2 is elevated because availability is High and privileges/UI are none, but the AT:P flag (attack requirement present) reflects that exploitation is not unconditional: the attacker must control how the input stream is chunked. No EPSS probability, no CISA KEV listing, and no confirmed public exploit were provided; the only exploitation-relevant code is the regression test shipped with the fix, not a weaponized PoC. The vuln.today decision label is 'this_week', consistent with a widely-deployed library DoS that warrants prompt patching but is not flagged for emergency action. Net: a genuine priority because libexpat is ubiquitous and the flaw is remotely reachable, but the real-world risk is moderated by the DoS-only impact and the non-trivial precondition that the attacker control stream chunking into a specific external-entity subparser code path.

An application uses libexpat to parse attacker-supplied XML and registers an external-entity handler that creates a subparser (XML_ExternalEntityParserCreate). The attacker supplies input crafted so the subparser receives an empty, non-final first buffer, which mishandles the XML_TOK_NONE token; a subsequent parse call then dereferences a NULL pointer in externalEntityInitProcessor2() and crashes the process. No public weaponized exploit was provided - only the vendor's regression test demonstrates the crash condition.