libexpat project has 6 CVEs on record between 2025 and 2026. The busiest recent month was March 2026 with 3. The median CVSS is 3.5 (low). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 3.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-59375High· 7.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.42CVE-2026-32777Medium· 4.0libexpat before 2.7.5 allows an infinite loop while parsing DTD content.22CVE-2026-32776Medium· 4.0libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.22CVE-2026-41080Low· 2.9libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.16CVE-2026-32778Low· 2.9libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.16
libexpat project vulnerabilities
CVEs affecting libexpat project, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-41080Low· 2.9libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-32777Medium· 4.0libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32776Medium· 4.0libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32778Low· 2.9libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2025-66382Low· 2.9In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2025-59375High· 7.5libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.