CVE-2026-113351 — Vulnerability intelligence
libexpat project — libexpat
Published:
- CVSS
- 8.2
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.