In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
CVSS Details
- CVSS 3.1 Base Score: 6.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qt6-qtwebengineUpgrade expat | Feb 4, 2026 | Jan 30, 2026 |
| Amazon Linux Ami 2 | — | Upgrade firefoxUpgrade expatUpgrade thunderbirdUpgrade expat-staticUpgrade expat-debuginfoUpgrade expat-devel | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade expat-staticUpgrade expat-develUpgrade firefoxUpgrade expat-debuginfoUpgrade firefox-debuginfoUpgrade expat-debugsourceUpgrade expatUpgrade firefox-debugsource | Feb 20, 2026 | Jan 30, 2026 |
| Debian | — | Upgrade expat | Aug 2, 2026 | Jan 30, 2026 |
| Dell Idrac | — | Upgrade Dell iDRAC to the latest version | Jul 15, 2026 | Jul 14, 2026 |
| Freebsd | — | Upgrade qt6-webengineUpgrade expatUpgrade qt6-pdf | Aug 20, 2026 | Aug 20, 2026 |
| Ibm Aix | — | Apply the fix or workaround for python_advisory18Apply the fix or workaround for perl_advisory13 | Mar 18, 2026 | Mar 17, 2026 |
| Ubuntu | — | Upgrade libxmltok1 (Ubuntu Pro)Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade libexpat1 (Ubuntu Pro)Upgrade expatUpgrade libexpat1Upgrade lib64expat1 (Ubuntu Pro)Upgrade expat (Ubuntu Pro) | Feb 12, 2026 | Jan 30, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 30, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub