Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
libexpat before 2.8.2 may crash on special XML
published 4 months ago
Summary
The libexpat library, which many applications use to read XML files, can miscalculate the size of certain data in older versions. This mistake can cause the program to stop working or, in rare cases, allow an attacker to take control. Upgrade libexpat to version 2.8.2 or later, or apply any available patches, to eliminate the risk.
What to do
- Update bellsoft expat to version 2.8.2-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| BellSoft Hardened Containers:25 | bellsoft | expat |
>= 2.7.1-r0, < 2.8.2-r0 Fix: upgrade to 2.8.2-r0
|
| Alpaquita:23 | bellsoft | expat |
>= 2.5.0-r0, < 2.8.2-r0 Fix: upgrade to 2.8.2-r0
|
| Alpaquita:25 | bellsoft | expat |
>= 2.7.1-r0, < 2.8.2-r0 Fix: upgrade to 2.8.2-r0
|
| Alpaquita:stream | bellsoft | expat |
>= 2.4.9-r0, < 2.8.2-r0 Fix: upgrade to 2.8.2-r0
|
| BellSoft Hardened Containers:stream | bellsoft | expat |
>= 2.4.9-r0, < 2.8.2-r0 Fix: upgrade to 2.8.2-r0
|
| BellSoft Hardened Containers:23 | bellsoft | expat |
>= 2.5.0-r0, < 2.8.2-r0 Fix: upgrade to 2.8.2-r0
|
Original advisory text
BELL-CVE-2026-56403
References
- https://docs.bell-sw.com/security/cves/CVE-2026-56403 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published23 Jun 2026
Updated1 Jul 2026
First seen1 Jul 2026
Track software like this
Free during beta