libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Libexpat
  • Expat
Libexpat Project
  • Libexpat

No data.

No data.

References
Link Providers
https://cert-portal.siemens.com/productcert/html/ssa-457936.html cve-icon
https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0 cve-icon cve-icon cve-icon
https://github.com/libexpat/libexpat/pull/1393 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-77214 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-77214 cve-icon
https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer cve-icon cve-icon cve-icon
History

Tue, 10 Nov 2026 13:30:00 +0000

Type Values Removed Values Added
References

Tue, 27 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Libexpat Project
Libexpat Project libexpat
CPEs cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
Vendors & Products Libexpat Project
Libexpat Project libexpat

Sun, 11 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Libexpat
Libexpat expat
Vendors & Products Libexpat
Libexpat expat

Sat, 10 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 07 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.
Title libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L'}

cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-07T14:35:42.794Z

Updated: 2026-11-10T12:49:48.816Z

Reserved: 2026-08-20T18:25:46.943Z

Link: CVE-2026-77214

cve-icon Vulnrichment

Updated: 2026-10-10T02:26:05.425Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-07T15:17:53.327

Modified: 2026-11-10T13:19:39.863

Link: CVE-2026-77214

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-07T14:35:42Z

Links: CVE-2026-77214 - Bugzilla