ELA-1872-1 expat security update

Package	expat
Version	2.2.10-2+deb11u8 (bullseye)
Related CVEs	CVE-2026-25210 CVE-2026-50219 CVE-2026-56131 CVE-2026-56132 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407 CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-56412 CVE-2026-72522 CVE-2026-76957 CVE-2026-77214 CVE-2026-93990 CVE-2026-117610 CVE-2026-118370

• CVE-2026-25210

  The doContent function did not properly detect an integer overflow while reallocating the tag buffer for a long tag name, potentially resulting in a heap-based buffer overflow.

• CVE-2026-50219

  XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree and XML_ParserReset could be called from within a handler callback, which could lead to memory corruption, e.g. in language bindings for Expat.

• CVE-2026-56131

  XML_ResumeParser could be called from within a handler callback, bypassing the protection added for CVE-2026-50219.

• CVE-2026-56132

  A heap-based buffer overflow in doProlog caused by scaffold backing array reallocation which was mishandled when there was data-structure sharing across parsers.

• CVE-2026-56403

  An integer overflow in storeAtts and in xmlwf’s xcsdup could result in an undersized allocation.

• CVE-2026-56404

  An integer overflow in addBinding could result in an undersized allocation.

• CVE-2026-56405

  An integer overflow in getAttributeId could result in an undersized allocation.

• CVE-2026-56406

  An integer overflow in XML_ParseBuffer could result in incorrect buffer handling.

• CVE-2026-56407

  An integer overflow in the handling of entity text length could result in memory corruption.

• CVE-2026-56408

  An integer overflow in copyString could result in an undersized allocation.

• CVE-2026-56409

  An integer overflow in xmlwf when joining the output directory and file name could result in an undersized allocation.

• CVE-2026-56410

  An integer overflow in xmlwf’s resolveSystemId could result in an undersized allocation.

• CVE-2026-56411

  An integer overflow in xmlwf when allocating the notation list could result in an undersized allocation.

• CVE-2026-56412

  Character data handler calls in doCdataSection were not guarded against parser reentry, leaving a hole in the fix for CVE-2026-50219.

• CVE-2026-72522

  Low surrogates were treated as high surrogates in the *_toUtf16 functions, resulting in an out-of-bounds read and an infinite loop. Only applications using the UTF-16 build of the library (libexpatw) are affected.

• CVE-2026-76957

  Custom encoding callbacks were not protected against reentering the parser, a closely related issue to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

• CVE-2026-77214

  A heap buffer over-read vulnerability in XML_ParseBuffer allowed recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

• CVE-2026-93990

  Expat did not validate that a UTF-16 high surrogate was followed by a low surrogate, which could result in malformed UTF-16 data (unpaired surrogates) being accepted.

• CVE-2026-117610

  An empty non-final buffer passed to an external entity subparser could lead to a NULL pointer dereference, resulting in a denial of service.

• CVE-2026-118370

  A signed integer overflow of the attribute index and prefix counters in storeAtts could result in memory corruption.

For Debian 11 bullseye, these problems have been fixed in version 2.2.10-2+deb11u8.

We recommend that you upgrade your expat packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.