PT-2026-25630 · Libexpat · Libexpat

Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-32776

Mitre

CVSS v3.1

4.0

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-32776

Affected Products

Libexpat

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32776 · Security Note
• https://github.com/libexpat/libexpat/pull/1159 · Note
• https://github.com/libexpat/libexpat/pull/1158 · Note