CVE-2026-24515

libexpat: libexpat null pointer dereference

Published Jan 23, 2026 CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Description

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

Analysis

Technical impact

The vulnerability resides in libexpat, where the function XML_ExternalEntityParserCreate fails to copy user data for unknown encoding handlers, leading to a null pointer dereference. This flaw can cause an application to crash when processing XML input that specifies an unfamiliar encoding, resulting in a denial of service. The weakness is classified as CWE‑476, a null pointer dereference.

Affected Systems

All installations of the libexpat library older than version 2.7.4 are potentially affected. Applications that embed libexpat and invoke XML_ExternalEntityParserCreate—such as web servers, document processors, or other XML‑handling software—are at risk if they are linked against an unpatched library.

Risk and Exploitability

The CVSS score of 2.9 indicates a low severity impact, and the EPSS score of less than 1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. Attackers would need to supply crafted XML content to trigger the crash, so an attacker must have the ability to influence input to the vulnerable parser.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

libexpat project

libexpat

unaffected

Version	Status	Constraints
`0`	affected	< 2.7.4

Configuration 1 [-]

cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade libexpat to version 2.7.4 or later, which includes the null‑check fix.
If an upgrade is not immediately feasible, disable the use of XML_ExternalEntityParserCreate with unknown encoding handlers or turn off external entity parsing altogether.
Review the application’s XML processing pipeline for additional null‑dereference risks and apply input validation or configuration hardening as needed.

Generated by OpenCVE AI on April 18, 2026 at 03:13 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4807-1	expat security update
Debian DSA	DSA-6404-1	expat security update
Ubuntu USN	USN-8022-1	Expat vulnerabilities
Ubuntu USN	USN-8022-2	Expat vulnerabilities
Ubuntu USN	USN-8023-1	xmltok library vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.201% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://github.com/libexpat/libexpat/pull/1131
https://nvd.nist.gov/vuln/detail/CVE-2026-24515
https://www.cve.org/CVERecord?id=CVE-2026-24515

History

Nov 10, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Jun 2, 2026 2:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Jan 28, 2026 12:15 AM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		libexpat: libexpat null pointer dereference
References		https://nvd.nist.gov/vuln/detail/CVE-2026-24515 https://www.cve.org/CVERecord?id=CVE-2026-24515
Metrics	threat_severity `None`	threat_severity `Low`

Jan 23, 2026 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 23, 2026 8:00 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
First Time appeared		Libexpat Project Libexpat Project libexpat
Weaknesses		CWE-476
CPEs		cpe:2.3:a:libexpat_project:libexpat::::::::
Vendors & Products		Libexpat Project Libexpat Project libexpat
References		https://github.com/libexpat/libexpat/pull/1131
Metrics		cvssV3_1 `{'score': 2.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}`