CVE-2026-76956
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In libexpat versions 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, making it vulnerable to hash flooding attacks, causing denial of service via crafted XML content.
Risk Assessment
An attacker can remotely cause a denial of service by sending specially crafted XML, potentially disrupting applications using libexpat.
Recommendation
It is recommended to immediately upgrade libexpat to version 2.8.4 or later, which includes the fix.
Other vulnerabilities in libexpat
See all- CVE-2024-45490High
An issue was discovered in libexpat before 2.6.3, where xmlparse.c does not reject a negative length for XML_ParseBuffer.
- CVE-2017-11742High
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat versions 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory due to an untrusted search path, known as DLL hijacking.
- CVE-2017-9233High
XML External Entity vulnerability in libexpat 2.2.0 and earlier allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
- CVE-2024-50602Medium
Issue in libexpat before version 2.6.4. The XML_ResumeParser function can crash if XML_StopParser stops/suspends an unstarted parser.
- CVE-2024-45492Critical
An issue was discovered in libexpat before version 2.6.3, which can lead to an integer overflow in the nextScaffoldPart function in xmlparse.c on 32-bit platforms.
- CVE-2024-45491Critical
An issue was discovered in libexpat before version 2.6.3 related to integer overflow in the dtdCopy function in xmlparse.c. This issue occurs on 32-bit platforms where UINT_MAX equals SIZE_MAX.
- CVE-2026-76957Medium
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
- CVE-2026-72522Medium
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
- CVE-2026-56412Medium
In libexpat before version 2.8.2, XML_TOK_DATA_CHARS is not considered in doCdataSection, leading to a lack of handler call depth tracking in cases of policy violation. This can result in a use-after-free error.
- CVE-2026-56411Medium
In libexpat before version 2.8.2, there is an integer overflow in the xmlwf function that can occur when processing NOTATION declarations in endDoctypeDecl.
Original NVD description (English source)
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.