libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3.12-debugUpgrade python3.12Upgrade python3.12-develUpgrade python3.12-tkinterUpgrade mingw32-fontconfigUpgrade python3.12-rpm-macrosUpgrade python3.12-libsUpgrade mingw64-fontconfigUpgrade mingw64-expatUpgrade mingw32-expatUpgrade python3.12-idleUpgrade python3.12-testUpgrade expat-develUpgrade expat | Nov 21, 2025 | Nov 19, 2025 |
| Alpine Linux | — | Upgrade expat | Sep 22, 2025 | Sep 15, 2025 |
| Amazon Linux Ami 2 | — | Upgrade firefoxUpgrade thunderbird | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade expat-debugsourceUpgrade xmlrpc-c-appsUpgrade xmlrpc-c-client++-debuginfoUpgrade xmlrpc-c-client-debuginfoUpgrade expatUpgrade xmlrpc-cUpgrade firefox-debugsourceUpgrade expat-staticUpgrade xmlrpc-c-c++-debuginfoUpgrade expat-debuginfoUpgrade xmlrpc-c-apps-debuginfoUpgrade firefoxUpgrade xmlrpc-c-client++Upgrade xmlrpc-c-c++Upgrade expat-develUpgrade xmlrpc-c-clientUpgrade firefox-debuginfoUpgrade xmlrpc-c-debuginfo | Sep 30, 2025 | Sep 15, 2025 |
| Apple Osx Libexpat | — | Upgrade macOS to the latest version | Feb 12, 2026 | Feb 11, 2026 |
| Debian | — | Upgrade thunderbirdUpgrade expatUpgrade firefox-esr | Mar 30, 2026 | Sep 15, 2025 |
| Freebsd | — | Upgrade expat2 | Dec 10, 2025 | Sep 17, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade expat | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade expat | Dec 12, 2025 | Dec 11, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade expat | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade expat | Dec 12, 2025 | Dec 11, 2025 |
| Ibm Aix | — | Apply the fix or workaround for python_advisory17 | Nov 20, 2025 | Nov 19, 2025 |
| Ibm Http_server | — | Apply IBM HTTP Server Interim Fix PH68462Apply IBM HTTP Server version 9.0.5.27 or laterApply IBM HTTP Server version 8.5.5.29 or later | Mar 25, 2026 | Dec 15, 2025 |
| Mfsa2026 20 | — | Upgrade to Mozilla Firefox version 149.0Upgrade to the latest version of Mozilla Firefox | Mar 27, 2026 | Mar 24, 2026 |
| Mfsa2026 22 | — | Upgrade to Mozilla Firefox ESR version 140.9Upgrade to the latest version of Mozilla Firefox | Mar 27, 2026 | Mar 24, 2026 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 140.9Upgrade to the latest version of Mozilla Thunderbird | Mar 27, 2026 | Mar 24, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Feb 13, 2026 |
| Oracle Httpserver | — | Apply patch 38856415 to Oracle HTTP Server 12.2.1.4.0.Apply patch 38853418 to Oracle HTTP Server 14.1.2.0.0. | Sep 30, 2026 | Sep 15, 2025 |
| Oracle_linux | — | Upgrade mingw64-fontconfigUpgrade python3.12-idleUpgrade python3.12-rpm-macrosUpgrade mingw64-expatUpgrade python3.12-tkinterUpgrade python3.12Upgrade expat-develUpgrade python3.12-testUpgrade python3.12-debugUpgrade mingw32-expatUpgrade expatUpgrade python3.12-develUpgrade python3.12-libsUpgrade mingw32-fontconfig | Nov 4, 2025 | Sep 15, 2025 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Sep 15, 2025 |
| Redhat_linux | — | Upgrade expat-develUpgrade python3.12-debugsourceUpgrade mingw32-expat-debuginfoUpgrade python3.12-develUpgrade python3.12-idleUpgrade mingw64-fontconfig-debuginfoUpgrade python3.12-testUpgrade python3-develUpgrade python-unversioned-commandUpgrade python3-idleUpgrade python3.12-rpm-macrosUpgrade mingw32-fontconfig-debuginfoUpgrade python3-libsUpgrade mingw32-expatUpgrade expat-debuginfoUpgrade python3.12-debugUpgrade python3.12-debuginfoUpgrade python3-tkinterUpgrade mingw64-expatUpgrade python3.12-libsUpgrade expat-debugsourceUpgrade mingw32-fontconfigUpgrade python3.12-tkinterUpgrade mingw64-fontconfigUpgrade expatUpgrade python3Upgrade python3-debugUpgrade mingw64-expat-debuginfoUpgrade python3.12No solution existsUpgrade python3-test | Nov 21, 2025 | Sep 15, 2025 |
| Rocky_linux | — | Upgrade python3-tkinterUpgrade python3-idleUpgrade python3-develUpgrade python3.12-libsUpgrade python3.12-debuginfoUpgrade python3.12-debugUpgrade python3-debugUpgrade python3.12-testUpgrade python3-libsUpgrade expatUpgrade python3Upgrade python3.12-debugsourceUpgrade expat-debuginfoUpgrade python3.12-idleUpgrade python3.12Upgrade expat-develUpgrade python3-testUpgrade expat-debugsourceUpgrade python3.12-develUpgrade python3.12-tkinter | Feb 5, 2026 | Nov 28, 2025 |
| Suse | — | Upgrade libexpat-develUpgrade expatUpgrade libexpat1Upgrade libexpat1-32bitUpgrade libexpat-devel-32bit | Dec 5, 2025 | Oct 9, 2025 |
| Ubuntu | — | Upgrade libexpat1-devUpgrade expatUpgrade libexpat1 | Feb 12, 2026 | Sep 15, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Sep 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub