2 mentions in 7 days · 3 in 30 days · 3 total · first seen · last
Ubuntu fixed libxmltok integer flaws CVE-2026-56404 and CVE-2026-56405 that can crash processes via crafted files.
Ubuntu Security Notice USN-8872-1 says Expat, bundled in the xmltok library, mishandles certain integer arithmetic. If a user or automated system opens a specially crafted file, an attacker could cause a denial of service. The issues are tracked as CVE-2026-56404 and CVE-2026-56405. The notice does not describe exploitation in the wild.
libexpat 2.9.0 patches CVE-2026-77214 and CVE-2026-102633, including a 32-bit integer overflow.
Sebastian Pipping told oss-security that libexpat 2.9.0, also called Expat 2.9.0, fixes two vulnerabilities. CVE-2026-102633 is an integer overflow in expat_realloc on 32-bit platforms. CVE-2026-77214 adds validation of the len parameter against available buffer capacity in XML_ParseBuffer. The note does not say either flaw is being exploited.
Ubuntu's USN-8813-1 patches Expat flaws that can crash the parser or allow code execution.
Ubuntu published USN-8813-1 for vulnerabilities in the Expat XML parser. Integer-arithmetic issues (CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411) could let an attacker cause a denial of service. Separate flaws in handler-call-depth tracking (CVE-2026-56131) and memory handling (CVE-2026-56132) could crash Expat or lead to arbitrary code execution. The notice also describes incorrect Unicode handling; it does not report active exploitation.