Aggregates CVE and security vulnerability intelligence across all libexpat_project-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk buffer overflow, vendor risk memory corruption, and vendor risk xxe, with potential vendor impact application crash across vendor surface software deployment use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2025-66382 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | [email protected] | 2.9 | 0.18% | 2025-11-28 | 2026-06-17 |
| CVE-2025-59375 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. | [email protected] | 7.5 | 1.28% | 2025-09-14 | 2026-06-17 |
| CVE-2024-50602 | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. | [email protected] | 5.9 | 1.04% | 2024-10-27 | 2026-06-17 |
| CVE-2024-45492 | An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | [email protected] | 9.8 | 1.39% | 2024-08-29 | 2026-06-17 |
| CVE-2024-45491 | An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | [email protected] | 9.8 | 1.14% | 2024-08-29 | 2026-06-17 |
| CVE-2024-45490 | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. | [email protected] | 7.5 | 1.69% | 2024-08-29 | 2026-06-17 |
| CVE-2024-28757 | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). | [email protected] | 7.5 | 2.01% | 2024-03-10 | 2026-06-17 |
| CVE-2023-52426 | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. | [email protected] | 5.5 | 0.37% | 2024-02-04 | 2026-06-17 |
| CVE-2023-52425 | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | [email protected] | 7.5 | 1.81% | 2024-02-04 | 2026-06-17 |
| CVE-2022-43680 | In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. | [email protected] | 7.5 | 2.26% | 2022-10-24 | 2026-06-17 |
| CVE-2022-40674 | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. | [email protected] | 8.1 | 1.76% | 2022-09-14 | 2026-06-17 |
| CVE-2022-25315 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | [email protected] | 9.8 | 4.78% | 2022-02-18 | 2026-06-17 |
| CVE-2022-25314 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | [email protected] | 7.5 | 4.65% | 2022-02-18 | 2026-06-17 |
| CVE-2022-25313 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | [email protected] | 6.5 | 3.27% | 2022-02-18 | 2026-06-17 |
| CVE-2022-25236 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | [email protected] | 9.8 | 35.87% | 2022-02-15 | 2026-06-17 |
| CVE-2022-25235 | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. | [email protected] | 9.8 | 4.96% | 2022-02-15 | 2026-06-17 |
| CVE-2022-23990 | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. | [email protected] | 7.5 | 3.96% | 2022-01-26 | 2026-06-17 |
| CVE-2022-23852 | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. | [email protected] | 9.8 | 4.52% | 2022-01-23 | 2026-06-17 |
| CVE-2022-22827 | storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | [email protected] | 8.8 | 2.78% | 2022-01-10 | 2026-06-17 |
| CVE-2022-22826 | nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | [email protected] | 8.8 | 2.78% | 2022-01-10 | 2026-06-17 |