CVE-2026-117610— libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

Quick assessment

Affected

libexpat libexpat

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libexpat 2.9.0 及更早版本存在一个空指针解引用漏洞，该漏洞位于 lib/xmlparse.c 文件中的 externalEntityInitProcessor2() 函数。该函数未能正确处理来自空输入的 XML_TOK_NONE 令牌。能够控制流分块的攻击者可强制对外部实体子解析器执行首次非最终的空解析，从而导致后续解析时应用程序崩溃。

CVSS 5.9 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

Source: CVE Program / CVE List V5

Vulnerability Description

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
libexpat	libexpat	0 ~ 2.9.0	-

II. Public POCs for CVE-2026-117610

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117610

请登录查看更多情报信息。

Vendor Pages for CVE-2026-117610 (1)

🔗 GitHub - libexpat/libexpat: :herb: Fast streaming XML parser written in C99 with >90% test coverage; moved from SourceForge to GitHub · GitHub product

Other References for CVE-2026-117610 (4)

https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510 technical-description
https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d patch
https://github.com/libexpat/libexpat/pull/1444 patch issue-tracking
https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117610

IV. Related Vulnerabilities

Same product: libexpat

Same vendor: libexpat

Same weakness: CWE-476