Zero Radar
← feed
HighVulnerabilityupdated 26 Oct 2026, 12:39 UTC

expat XML parser: several flaws allow info leaks, crashes and code execution

expat is a widely used library that reads XML data inside many programs. Attackers can send specially crafted XML to crash those programs, read data they should not see, or in some cases run their own code.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends XMLCrafted XML input reaches the application
  2. 2Parser flaw triggeredInteger overflow or unchecked input in expat
  3. 3Memory or data exposedInformation may leak to the attacker
  4. 4Crash or code runDenial of service, possibly code execution
  5. ResultApplication crashes or attacker gains control

What happened

Multiple vulnerabilities in the expat XML parsing library (libexpat), including an integer overflow, enable information disclosure, denial of service, and possibly arbitrary code execution.

Why it is dangerous: Any application or system that parses XML with expat may be crashed or leak information; the local-attacker code execution risk could allow full compromise of the affected system.

Are you affected?

You are affected if you run software that uses expat or libexpat for XML parsing, since the affected versions are not specified in the material.

expat / libexpat (exact versions not stated in the material)

What to do

  1. Identify which applications and systems on your network use expat or libexpat
  2. Check your software vendors for expat updates and install them as soon as available
  3. Monitor the CERT-Bund (BSI) advisory for patched version details

Timeline

  1. 26 Oct 2026, 11:45 UTC
    Publicly disclosed
  2. 26 Oct 2026, 11:45 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 26 Oct 2026, 11:54 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 12:29 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  5. 26 Oct 2026, 12:29 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  6. 26 Oct 2026, 12:29 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  7. 26 Oct 2026, 12:30 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  8. 26 Oct 2026, 12:30 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  9. 26 Oct 2026, 12:30 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  10. 26 Oct 2026, 12:30 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  11. 26 Oct 2026, 12:30 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  12. 26 Oct 2026, 12:31 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  13. 26 Oct 2026, 12:31 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)

Sources 11 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-e8c624a2
Disclosed
26 Oct 2026, 11:45 UTC
On Zero Radar
26 Oct 2026, 11:54 UTC (9 min after disclosure)
Last change
26 Oct 2026, 12:39 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

expat XML parser: several flaws allow info leaks, crashes and code execution · Zero Radar