PT-2026-27317 · Expat+1 · Expat+1

Titan Team · Published 2026-03-24 · Updated 2026-05-05 · CVE-2026-4739

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/S:P/AU:Y/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions InsightSoftwareConsortium ITK versions prior to 2.7.1

Description An integer overflow or wraparound condition exists in the Expat parser within the ITK software. This issue is network-reachable and allows for automatable exploitation. The vulnerability is located in the expat modules under the Modules/ThirdParty/Expat/src directory.

Recommendations Update to version 2.7.1 or later.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-4739

Affected Products

Expat

Itk

References · 10

• https://github.com/InsightSoftwareConsortium/ITK/pull/5351 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4739 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-4739 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-4739 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4739 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4739 · Security Note
• https://ubuntu.com/security/CVE-2026-4739 · Vendor Advisory
• https://twitter.com/CVEarity/status/2036846712535531766 · Twitter Post
• https://t.me/cveNotify/162259 · Telegram Post
• https://twitter.com/0dayPublishing/status/2036286706966466707 · Twitter Post