Libexpat EUVD-2026-12349

| CVE-2026-32777 MEDIUM

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-03-16 mitre

Denial Of Service Libexpat Libexpat Project

5.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-835 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Loop termination conditions MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates local attack vector with low complexity and no privileges required, but limited to availability impact with no confidentiality or integrity consequences. The attack vector is restricted to local exploitation, which significantly limits real-world exposure compared to network-based vulnerabilities. However, the combination of low attack complexity, no user interaction requirement, and the widespread use of libexpat in server software means that local privilege escalation chains or container escape scenarios could leverage this to cause service disruptions. The lack of confidentiality or integrity impact reduces CVSS severity, but for critical infrastructure or high-availability systems relying on XML parsing, a reliable denial of service vector represents material risk. Assessment: moderate real-world priority due to limited attack vector, but organizations with exposed local access or service-level XML parsing requirements should prioritize patching.
Exploit ScenarioDerived	An attacker with local access to a system running vulnerable libexpat-dependent software crafts a malicious XML file with a specially-constructed DTD that triggers the infinite loop condition in the parser. When an application attempts to parse this XML file (for example, a configuration file parser, document processor, or web service accepting XML uploads), the libexpat parser enters an unbounded loop consuming 100% CPU resources until the process is killed or the system runs out of memory. In a containerized or multi-tenant environment, this could cascade to denial of service affecting other services on the same host or trigger automatic restart loops that degrade availability.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Mar 16, 2026

libexpat before version 2.7.5 contains an infinite loop vulnerability triggered during DTD (Document Type Definition) parsing, allowing local attackers to cause a denial of service condition. The vulnerability affects all applications and libraries that depend on libexpat for XML parsing, with a CVSS score of 4.0 reflecting limited severity due to local-only attack vector and availability impact. While the CVSS base score is moderate, the infinite loop condition presents a real denial of service risk for services that parse untrusted XML documents containing malicious DTD content.

RemediationAI

Upgrade libexpat to version 2.7.5 or later immediately. On Linux systems, use your distribution's package manager (apt, yum, dnf, etc.) to update libexpat and any dependent packages. For applications that embed libexpat, update to the latest version of that application which includes the patched libexpat library. Until patching is completed, restrict local access to systems parsing untrusted XML content and consider implementing input validation or XML parsing timeouts at the application level to detect and interrupt infinite loops. If your organization cannot patch immediately, disable XML DTD processing where possible via application configuration settings, as many XML parsers offer options to restrict DTD parsing to reduce attack surface.

Affected VersionsENISA

libexpat 0 <2.7.5

Affected Packages

euvd libexpat fix: 2.7.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

libexpat is a widely-used C library for parsing XML documents (CPE: cpe:2.3:a:libexpat:libexpat). The vulnerability exists in the DTD parsing logic, which processes Document Type Definition declarations that can include entity definitions, attribute declarations, and notation declarations. The root cause is classified under CWE-835 (Infinite Loop), indicating that the parser enters an unbounded loop condition when processing certain DTD constructs rather than properly terminating parsing or raising an error. This is a classic resource exhaustion vulnerability where malformed or specifically crafted DTD content causes the parser to consume CPU resources indefinitely, preventing normal operation of any application using the affected libexpat version for XML parsing operations.

Know when Libexpat gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE MEDIUM

Red Hat 4.0 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

3

CVSS changed

Jul 14, 2026 - 13:22 NVD

4.0 (MEDIUM) 5.5 (MEDIUM)

Patch available

Apr 16, 2026 - 05:29 EUVD

2.7.5

CVE Published

Mar 16, 2026 - 06:58 nvd

MEDIUM 4.0

DescriptionNVD

libexpat before 2.7.5 allows an infinite loop while parsing DTD content.

Executive ViewAI

Why It Matters

Organizations using libexpat before 2.7.5 should be aware of moderate risk from CVE-2026-32777 rated CVSS 4.0. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Threat Intel

1

1 source

Data Quality

8 sources

Confidence: High

EUVD

CVE.org

EPSS CISA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat Yes

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

No

Human Impact

Low

Priority Score

38

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: +10

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in libexpat XML Parser Vulnerabilities

View all 3

CVE-2026-32778 MEDIUM

CVE-2026-32776 MEDIUM

More in Libexpat

View all

CVE-2022-25315 CRITICAL Act Now POC

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),

CVE-2019-15903 HIGH This Week POC

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too

CVE-2026-93990 HIGH This Week POC

Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high s

CVE-2022-43680 HIGH This Week POC

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti

CVE-2024-28757 HIGH This Week POC

Alpine Linux: expat fixed in 2.6.2-r0

CVE-2017-9233 HIGH This Week POC

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p

CVE-2025-59375 HIGH This Week POC

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is

CVE-2026-45186 HIGH This Week POC

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2013-0340 MEDIUM This Month POC

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE

CVE-2016-0718 CRITICAL Act Now

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m

CVE-2024-45492 CRITICAL Act Now

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp

CVE-2024-45491 CRITICAL Act Now

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all

CVE-2024-20353 HIGH POC

CVE-2020-13935 HIGH POC

CVE-2017-16944 HIGH POC

CVE-2022-0778 HIGH POC

CVE-2024-43366 CRITICAL POC

CVE-2026-25533 HIGH POC

CVE-2018-8002 HIGH POC

CVE-2026-66730 HIGH POC

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2011-0611 HIGH POC

CVE-2012-1889 HIGH POC

CVE-2012-0507 CRITICAL POC

CVE-2014-1761 HIGH POC

CVE-2015-5122 CRITICAL POC

CVE-2011-0609 HIGH POC

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/ltss/sle12.5/sles12sp5:8.5.217	Affected
Container suse/manager/4.3/proxy-httpd:latest Container suse/manager/4.3/proxy-salt-broker:4.3.17.9.66.5 Container suse/manager/4.3/proxy-ssh:latest Container suse/manager/4.3/proxy-tftpd:4.3.17.9.66.5 Container suse/sle-micro/base-5.5:latest Container suse/sle-micro/kvm-5.5:latest Image SLES15-SP5-Micro-5-5 Image SLES15-SP5-Micro-5-5-Azure	Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.156 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.123 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.140 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.154 Container suse/sl-micro/6.0/toolbox:13.2-9.91 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.86 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.110 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.112 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.100 Image SL-Micro	Affected
Container suse/sle-micro-rancher/5.2:latest Container suse/sle-micro/5.2/toolbox:14.2-7.11.264	Affected
Container suse/sles/16.0/toolbox:16.3-1.42	Affected

Threat IntelligenceMISP

CISA Advisories

ICSA-26-155-04

Sources: CISA (public domain)

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-32777 ADVISORY https://ubuntu.com/security/notices/USN-8790-1 ADVISORY https://vuldb.com/?id.351221 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1137/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1159/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1166/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1352/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20963/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20969/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20985/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21031/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21062/ REF https://cert-portal.siemens.com/productcert/html/ssa-082556.html REF https://github.com/libexpat/libexpat/issues/1161 REF https://github.com/libexpat/libexpat/pull/1159 REF https://github.com/libexpat/libexpat/pull/1162 REF https://issues.oss-fuzz.com/issues/486993411

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy