WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product libexpat✕
Overview 28 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
28matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 3 10.7% Not applicable 25 89.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 28 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 28 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 3 10.7% Forecast only 0 0.0% No public exploit 25 89.3%
split by peak 10 / year
Not applicable: 25Outside Waratek scope: 3 High: 28 not blocked: 28 No public exploit: 25Proof of concept only: 3
20162 Not applicable2 High2 not blocked2 No public exploit2 20172 Not applicable2 High2 not blocked2 No public exploit2 20180 20192 Not applicable2 High2 not blocked2 No public exploit2 20200 20210 20229 Outside Waratek scope3 Not applicable6 High9 not blocked9 Proof of concept only2 No public exploit7 20230 20242 Not applicable2 High2 not blocked2 No public exploit2 20251 Not applicable1 High1 not blocked1 No public exploit1 202610 Not applicable10 High10 not blocked10 Proof of concept only1 No public exploit9
20162017201820192020202120222023202420252026
28 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-118370 High 2026-10-28 Not applicable No public exploit libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
CVE-2026-117610 High 2026-10-28 Not applicable No public exploit libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
CVE-2026-115506 High 2026-10-22 Not applicable Proof of concept only libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
CVE-2026-113351 High 2026-10-20 Not applicable No public exploit libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
CVE-2026-76957 High 2026-08-20 Not applicable No public exploit libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-76956 High 2026-08-20 Not applicable No public exploit In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
CVE-2026-66046 High 2026-08-18 Not applicable No public exploit Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
CVE-2026-45186 High 2026-05-10 Not applicable No public exploit In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-41080 High 2026-04-16 Not applicable No public exploit libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-25210 High 2026-01-30 Not applicable No public exploit In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
CVE-2025-59375 High 2025-09-15 Not applicable No public exploit libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVE-2024-28757 High 2024-03-10 Not applicable No public exploit libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2023-52425 High 2024-02-04 Not applicable No public exploit libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
CVE-2022-43680 High 2022-10-24 Not applicable No public exploit In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
CVE-2022-40674 High 2022-09-14 Not applicable No public exploit libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
CVE-2022-25314 High 2022-02-18 Not applicable No public exploit In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-23990 High 2022-01-26 Outside Waratek scope No public exploit Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
CVE-2022-22827 High 2022-01-10 Not applicable No public exploit storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22826 High 2022-01-10 Not applicable No public exploit nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22825 High 2022-01-10 Not applicable No public exploit lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2021-46143 High 2022-01-06 Outside Waratek scope Proof of concept only In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
CVE-2021-45960 High 2022-01-01 Outside Waratek scope Proof of concept only In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
CVE-2019-15903 High 2019-09-04 Not applicable No public exploit In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVE-2018-20843 High 2019-06-24 Not applicable No public exploit In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
CVE-2017-11742 High 2017-07-30 Not applicable No public exploit The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.
CVE-2017-9233 High 2017-07-25 Not applicable No public exploit XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
CVE-2016-4472 High 2016-06-30 Not applicable No public exploit The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
CVE-2016-5300 High 2016-06-16 Not applicable No public exploit The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.