CVE-2026-24515Disclosure(libexpat_project / libexpat)

LOWCVSS 2.5 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch libexpat_project libexpat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

libexpat_project CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-476

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libexpat

Threat summary

Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 8 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 4d ago at 2 mentions (2026-02-05); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

libexpat_project

Products

libexpat

Deep dive

Activity timeline8 mentions / 6d

Signal classification3 categories

Disclosure

450.0%

Patch

337.5%

General

112.5%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-04	1	General1
2026-02-05	2	Disclosure2
2026-02-08	1	Patch1
2026-02-11	2	Disclosure2
2026-02-27	1	Patch1
2026-03-04	1	Patch1

Full discourse8 posts

Open Source Security mailing list@oss_security243d
Patch
libexpat 2.7.4 fixes 2 CVEs https://www.openwall.com/lists/oss-security/2026/01/31/1 CVE-2026-24515 NULL pointer dereference CVE-2026-25210 Integer overflow
Post summary
The text announces that libexpat 2.7.4 includes patches for CVE-2026-24515 (NULL pointer dereference) and CVE-2026-25210 (Integer overflow), but no exploit or active usage is reported.
030101848
4.4K followersView on X
koraycodes@koraycodes218d
Patch
Memory safety is non-negotiable for high-performance systems. 🧠 The bundled libexpat library is upgraded to 2.7.4. Fixes for CVE-2026-24515 and CVE-2026-25210 prevent memory amplification and crashes during XML parsing. A critical "use-after-free" bug in the ssl module has been neutralized. 🔒
Post summary
The update to libexpat 2.7.4 applies patches for CVE‑2026‑24515 and CVE‑2026‑25210, fixing memory amplification and crash issues, and also resolves a critical use‑after‑free bug in the SSL module. No active exploitation or PoC is reported.
1000040
790 followersView on X
Ferramentas Linux@Cezar_H_Linux223d
Patch
Urgent: #SUSE Linux Micro 6.1 patches Expat library with fixes for CVE-2026-24515 (NULL dereference) and CVE-2026-25210 (integer overflow). Read more: 👉 https://tinyurl.com/ya558teh #Security https://t.co/8Iy2xUVJbT
Post summary
SUSE Linux Micro 6.1 has issued patches for CVE‑2026‑24515 (NULL dereference) and CVE‑2026‑25210 (integer overflow) in the Expat library, with a link to further details.
0000056
1.3K followersView on X
ThreatCluster@threatcluster239d
Disclosure
Expat XML parser flaws in Ubuntu 25.10, 22.04 LTS and older allow DoS or possible code execution via crafted XML, impacting xmltok (CVE-2025-59375, CVE-2026-24515, CVE-2026-25210). #Linux https://threatcluster.io/cluster/critical-expat-vulnerabilities-affect-multiple-ubuntu-releas-7b8a8fa0
Post summary
Expat XML parser flaws in Ubuntu 25.10, 22.04 LTS and older allow DoS or possible code execution via crafted XML, impacting xmltok and involving CVE-2025-59375, CVE-2026-24515, CVE-2026-25210.
0000058
79 followersView on X
Ferramentas Linux@Cezar_H_Linux239d
Disclosure
USN-8023-1: libxmltok flaws (CVE-2026-24515 & CVE-2026-25210) are now public. Key takeaway: CVE-2026-25210 = Integer Overflow → Heap Overflow → Potential RCE. ⚠️ Patches ONLY in #Ubuntu Pro/ESM repos. Read more: 👉 https://tinyurl.com/fd6dsmfu #Security https://t.co/JR4e8Mh9LR
Post summary
The post announces the public disclosure of CVE‑2026‑24515 and CVE‑2026‑25210, highlights a potential RCE via an integer/heap overflow in libxmltok, and notes that patches are only available through Ubuntu Pro/ESM repos.
0000066
1.3K followersView on X
Ferramentas Linux@Cezar_H_Linux245d
Disclosure
🚨 CVE-2026-24515 Alert: Critical memory corruption flaw in Expat XML parser (v2.7.4). Widespread impact on Linux distros & apps. Exploitation could lead to RCE. Read more: 👉 https://tinyurl.com/35wft3y2 #Security #openSUSe https://t.co/uiXJq0trlP
Post summary
The tweet announces CVE‑2026‑24515, a critical memory corruption flaw in the Expat XML parser that could lead to remote code execution across Linux distributions.
0000075
1.3K followersView on X
Ferramentas Linux@Cezar_H_Linux245d
Disclosure
Just analyzed the new #SUSE expat advisory (2026-0386-1). Key takeaway: While SUSE rates it "Moderate," the NVD CVSS 3.1 score for the null dereference (CVE-2026-24515) is a Critical 9.8. Read more: 👉 https://tinyurl.com/5yvw6db4 #Security https://t.co/2Q4uvPoEye
Post summary
The tweet reports on a SUSE expat advisory for CVE-2026-24515, noting its critical CVSS score, but offers no PoC, exploit code, active exploitation evidence, or patch details.
0000054
1.3K followersView on X
Ferramentas Linux@Cezar_H_Linux246d
General
Just published a comprehensive analysis of the critical Expat XML parser vulnerability #Mageia Advisory 2026-0031 / CVE-2026-24515). Read more: 👉 https://tinyurl.com/2uyrtuhd #Security https://t.co/GOvh5xtRlk
Post summary
The tweet announces a comprehensive analysis of the critical Expat XML parser vulnerability CVE-2026-24515 linked to Mageia Advisory 2026-0031, with no PoC, exploit, or patch details provided.
0000050
1.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libexpat_project	libexpat	-	-	-

Explore more

Back to dashboard libexpat_project CVEs libexpat vulnerabilities

What researchers are saying

CVE-2026-24515

koraycodes[verified]@koraycodesPatch

The update to libexpat 2.7.4 applies patches for CVE‑2026‑24515 and CVE‑2026‑25210, fixing memory amplification and crash issues, and also resolves a critical use‑after‑free bug in the SSL module. No active exploitation or PoC is reported.

ThreatCluster[verified]@threatclusterDisclosure

Expat XML parser flaws in Ubuntu 25.10, 22.04 LTS and older allow DoS or possible code execution via crafted XML, impacting xmltok and involving CVE-2025-59375, CVE-2026-24515, CVE-2026-25210.

Open Source Security mailing list@oss_securityPatch

The text announces that libexpat 2.7.4 includes patches for CVE-2026-24515 (NULL pointer dereference) and CVE-2026-25210 (Integer overflow), but no exploit or active usage is reported.

Ferramentas Linux@Cezar_H_LinuxPatch

SUSE Linux Micro 6.1 has issued patches for CVE‑2026‑24515 (NULL dereference) and CVE‑2026‑25210 (integer overflow) in the Expat library, with a link to further details.

Ferramentas Linux@Cezar_H_LinuxDisclosure

The post announces the public disclosure of CVE‑2026‑24515 and CVE‑2026‑25210, highlights a potential RCE via an integer/heap overflow in libxmltok, and notes that patches are only available through Ubuntu Pro/ESM repos.

Ferramentas Linux@Cezar_H_LinuxDisclosure

The tweet announces CVE‑2026‑24515, a critical memory corruption flaw in the Expat XML parser that could lead to remote code execution across Linux distributions.

Ferramentas Linux@Cezar_H_LinuxDisclosure

The tweet reports on a SUSE expat advisory for CVE-2026-24515, noting its critical CVSS score, but offers no PoC, exploit code, active exploitation evidence, or patch details.

Ferramentas Linux@Cezar_H_LinuxGeneral

The tweet announces a comprehensive analysis of the critical Expat XML parser vulnerability CVE-2026-24515 linked to Mageia Advisory 2026-0031, with no PoC, exploit, or patch details provided.