PT-2026-25791 · Expat+4 · Expat+4

Bénédikt Tran + 2 · CVE-2026-4224 · Published 2026-01-01 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Expat (affected versions not specified)

Description The Expat parser, when used with a registered ElementDeclHandler, is susceptible to a C stack overflow when processing an inline document type definition with a deeply nested content model. This occurs during the parsing of XML documents containing complex and deeply nested DTD content models.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALSA-2026:10950

ALSA-2026:19019

ALSA-2026:19064

ALSA-2026:19176

ALSA-2026:19177

BDU:2026-04602

BIT-LIBPYTHON-2026-4224

BIT-PYTHON-2026-4224

BIT-PYTHON-MIN-2026-4224

CVE-2026-4224

ECHO-7DC2-599B-22CD

OESA-2026-1899

OESA-2026-1900

OESA-2026-1901

OESA-2026-1902

OPENSUSE-SU-2026:10469-1

OPENSUSE-SU-2026:10477-1

OPENSUSE-SU-2026:10478-1

OPENSUSE-SU-2026:10479-1

OPENSUSE-SU-2026:10480-1

OPENSUSE-SU-2026:10481-1

OPENSUSE-SU-2026:20517-1

PSF-2026-12

RHSA-2026:10950

RHSA-2026:19064

RHSA-2026:19177

RHSA-2026:7443

RHSA-2026:7661

RHSA-2026:8822

RHSA-2026:8824

SUSE-SU-2026:1206-1

SUSE-SU-2026:1292-1

SUSE-SU-2026:1296-1

SUSE-SU-2026:1345-1

SUSE-SU-2026:1349-1

SUSE-SU-2026:1354-1

SUSE-SU-2026:1376-1

SUSE-SU-2026:1385-1

SUSE-SU-2026:1417-1

SUSE-SU-2026:1530-1

SUSE-SU-2026:1715-1

SUSE-SU-2026:21104-1

SUSE-SU-2026:21178-1

SUSE-SU-2026:21254-1

USN-8509-1

Affected Products

Expat

Ibm Aix

Linuxmint

Red Os

Rocky Linux

References · 194

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4224.json · Exploit
• https://github.com/python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785 · Patch
• https://github.com/python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee · Patch
• https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3 · Patch
• https://github.com/python/cpython/pull/145987 · Patch
• https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768 · Patch
• https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:1296-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1206-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3644 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4224 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1349-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2026-4224 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8509-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4224 · Security Note