CVE-2026-113351: libexpat 2.7.2 through 2.9.0

Affected technology

libexpat · 2.7.2 through 2.9.0
libexpat

Description’s affected range: through 2.9.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated. Vendor/CNA’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality and integrity impact as none; availability impact as high.