Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Expat XML parser may let attackers run code

published 1 month ago

Summary

The Expat software used to read XML files has two serious bugs: one could let a malicious file cause the program to crash, and another could allow a hacker to run their own code on the server. Update the Expat library to the latest version as soon as possible to protect your systems.

What to do

Update rocky expat to version 0:2.5.0-6.el9_8.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Rocky Linux:9	rocky	expat	< 0:2.5.0-6.el9_8.3 Fix: upgrade to 0:2.5.0-6.el9_8.3

Original advisory text

Moderate: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking (CVE-2026-50219)

* expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow (CVE-2026-56132)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://errata.rockylinux.org/RLSA-2026:64812 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2484620 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2490669 Third Party Advisory
https://access.redhat.com/errata/RHSA-2026:64812 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

6.9 Medium

Timeline

Published9 Sep 2026

Updated9 Sep 2026

First seen9 Sep 2026

Sources

RLSA-2026:64812 · OSV

Track software like this

Free during beta