CyberRota Analysis
AI-GeneratedExpat versions up to 2.8.3 are vulnerable to an out-of-bounds read issue that can lead to memory corruption when processing XML with external entity parsers. This vulnerability can result in application crashes or potential exploitation through wild pointer dereferences. Organizations utilizing Expat for XML parsing should prioritize patching this vulnerability to mitigate risks associated with memory corruption and application stability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.