Description

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T18:16:51.887Z",
  "pubdate": "2026-08-20T18:16:51.887Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read and memory corruption flaw affecting the Expat XML parser library up to version 2.8.3. The root cause stems from a struct size mismatch between ELEMENT_TYPE members that was introduced by the fix for CVE-2026-66046. Attackers can trigger this vulnerability by processing maliciously crafted XML input using external entity parsers created via the XML_ExternalEntityParserCreate function. Successful exploitation allows an attacker to cause a wild pointer dereference resulting in a segmentation fault, or trigger a failure to properly normalize whitespace in non-CDATA attributes. The risk implication involves potential denial of service through application crashes. The vulnerability can be exploited by an unauthenticated attacker supplying untrusted XML data to systems utilizing vulnerable versions of Expat. Exploitation relies on the target application parsing specially crafted XML payloads containing external entities, leading to memory boundary violations within the attribute storage processing routines.",
  "technicalDetails": "The vulnerability resides in the Expat XML parsing library, specifically affecting versions up to 2.8.3. The root cause is a structural size mismatch occurring among ELEMENT_TYPE members. This discrepancy was inadvertently introduced during the implementation of the security fix for CVE-2026-66046. Specifically, the component responsible for attribute handling and storage, storeAtts, interacts with element type definitions where internal structure sizes diverge from expectations.\nDuring the parsing of XML documents that utilize external entity parsers instantiated via the XML_ExternalEntityParserCreate function, the vulnerable storeAtts function attempts to access the attIndex member. Due to the struct size mismatch, this access reads memory past the allocated boundaries of the ELEMENT_TYPE structure, resulting in an out-of-bounds read condition.\nThe attack flow proceeds as follows: First, an attacker constructs a specialized XML payload designed to invoke external entity parsing through XML_ExternalEntityParserCreate. Second, the attacker submits this malicious XML input to an application utilizing the vulnerable Expat library. Third, as the parser processes the document elements and attributes, the storeAtts function calculates memory offsets based on the flawed ELEMENT_TYPE member definitions. Fourth, the execution flow reads beyond the designated memory limits when evaluating the attIndex member. Finally, this out-of-bounds memory access either prevents the normalization of whitespace in non-CDATA attributes or triggers a wild pointer dereference, culminating in an application segmentation fault and subsequent denial of service.\nThe vulnerability requires no authentication or special privileges, as it can be triggered remotely if the target application processes untrusted XML inputs from network or local attack surfaces. The payload behavior centers on disrupting memory safety during attribute processing, leading directly to destabilization of the host process."
}