Bug 2562538 (CVE-2026-117610) - CVE-2026-117610 expat: expat: Denial of Service via NULL pointer dereference in external entity parsing
Summary: CVE-2026-117610 expat: expat: Denial of Service via NULL pointer dereference ...
Keywords:
Status: NEW
Alias: CVE-2026-117610
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-28 02:32 UTC by OSIDB Bzimport
Modified: 2026-11-04 10:58 UTC (History)
20 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-28 02:32:21 UTC 
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
Comment 1 Srikanth Balasubramanian 2026-11-04 10:58:06 UTC 
Internal — CVSS v3.1 / rating rationale (CVE-2026-117610)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H = 5.9 → Moderate
NVD: 7.5 (AC:L).

Metric notes:
- AV:N — network-delivered XML possible.
- AC:H — needs empty non-final first parse on external-entity subparser (stream chunking + external entities); not typical default RHEL XML usage.
- C:N / I:N / A:H — NULL deref crash / DoS; no demonstrated C/I impact.
Safeguards harden exploitation of memory bugs but do not stop this crash DoS.

NVD ≥7 → affected products AFFECTED+DELEGATED; RHEL 6 AFFECTED+OOSS.
Note You need to log in before you can comment on or make changes to this bug.