CVE-2026-117610 in libexpat
Summary
by MITRE • 10/28/2026
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within libexpat versions up through 2.9.0 represents a critical memory safety flaw located in the XML_TOK_NONE token handling logic of the externalEntityInitProcessor2 function found in xmlparse.c. This specific component is responsible for initializing and processing external entities during the parsing process, which is a fundamental operation when dealing with documents that reference resources outside their immediate scope such as included stylesheets or embedded media definitions. The core technical flaw arises from an improper validation check where the parser fails to adequately account for scenarios involving empty input streams. When the tokenizer encounters XML_TOK_NONE, indicating no tokens were found in the current chunk of data, the code path does not correctly handle this state if it occurs under specific conditions related to stream fragmentation and external entity subparsers.
This defect is particularly exploitable by attackers who possess control over how network or file streams are chunked during transmission or reading operations. By carefully manipulating the size and boundaries of these input chunks, an adversary can force a situation where an empty non-final first parse occurs on an external entity subparser. In this state, the parser initializes resources for processing the external content but receives no actual data tokens due to the empty nature of that specific chunk. The subsequent parsing operations then proceed under incorrect assumptions about the state of the internal structures associated with that subparser. Because the initial initialization did not properly guard against the absence of tokenized data in this edge case, later attempts to access or process elements within that context result in a NULL pointer dereference.
The operational impact of this vulnerability is primarily denial of service through application crash. When the program encounters the null reference during subsequent parsing steps, it triggers an immediate termination event rather than gracefully handling the error condition. For applications relying on libexpat to parse untrusted or semi-trusted XML data, such as web servers processing API requests, document management systems, or any software integrating external resources dynamically, this flaw can be leveraged to cause service interruptions. While the primary outcome is a crash, in complex environments where memory corruption might follow from undefined behavior after a null dereference attempt, there remains a theoretical risk of further exploitation leading to arbitrary code execution, although the immediate and most certain effect is system instability and unavailability.
From a classification perspective, this issue aligns with CWE-476 which denotes NULL Pointer Dereference vulnerabilities where software fails to check for null pointers before using them, often resulting in crashes or potential security bypasses depending on context. In terms of offensive tactics, this vulnerability supports techniques associated with resource exhaustion and denial of service within the MITRE ATT&CK framework, specifically those involving application layer attacks that target parsing engines to disrupt availability. The attack vector is classified as remote if the vulnerable parser processes data received over a network interface, making it relevant for internet-facing services.
Mitigation strategies should prioritize immediate upgrading to patched versions of libexpat released after 2.9.0 where this logic has been corrected to properly handle empty token states in external entity subparsers. For environments where updating is not immediately feasible, implementing strict input validation and size limiting on XML inputs can reduce the likelihood of triggering the specific chunking conditions required for exploitation. Additionally, deploying runtime protection mechanisms such as address space layout randomization and stack protectors may help mitigate the impact by preventing further memory corruption if a crash occurs, although these measures do not resolve the underlying logic error within the parser itself. Regular auditing of XML parsing configurations to ensure that external entity processing is restricted to trusted sources only can also reduce the attack surface available to potential adversaries seeking to manipulate stream chunking behavior.