CVE-2026-77214

Description

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
expat	26.10 stonking	Needs evaluation
	26.04 LTS resolute	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation
apache2	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
apr-util	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
cmake	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
ghostscript	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
texlive-bin	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
xmlrpc-c	26.10 stonking	Needs evaluation
	26.04 LTS resolute	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation
vnc4	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation
wbxml2	26.10 stonking	Needs evaluation
	26.04 LTS resolute	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
swish-e	26.10 stonking	Needs evaluation
	26.04 LTS resolute	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
insighttoolkit4	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
cadaver	26.10 stonking	Needs evaluation
	26.04 LTS resolute	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
gdcm	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Not affected
ayttm	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	16.04 LTS xenial	Needs evaluation
cableswig	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	16.04 LTS xenial	Needs evaluation
coin3	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation
matanza	26.10 stonking	Ignored
	26.04 LTS resolute	Ignored
	24.04 LTS noble	Ignored
	22.04 LTS jammy	Ignored
	20.04 LTS focal	Ignored
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
tdom	26.10 stonking	Needs evaluation
	26.04 LTS resolute	Needs evaluation
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
vtk	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation
smart	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation
firefox	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
thunderbird	26.10 stonking	Not affected
	26.04 LTS resolute	Not affected
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
libxmltok	26.10 stonking	Not in release
	26.04 LTS resolute	Not in release
	24.04 LTS noble	Needs evaluation
	22.04 LTS jammy	Needs evaluation
	20.04 LTS focal	Needs evaluation
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

Notes

sbeattie

paraview uses system expat xotcl uses system expat poco uses system expat gdcm uses system expat audacity uses system expat simgear uses system expat coin3 uses system expat as of 4.0.0~CMake~6f54f1602475+ds1-1 sitecopy uses system expat since 1:0.16.0-1 (dapper!) insighttoolkit uses system expat as of 4.12.1-dfsg1

mdeslaur

apache2 uses system expat apr-util uses system expat cmake uses system expat ghostscript uses system expat firefox uses system expat thunderbird uses system expat matanza embeds an expat fork to parse its own config file, there is no attack vector there, we will not be fixing matanza.

Severity score breakdown

CVSS version:

Base score 8.3 · High

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Attack requirements	Present
Privileges required	None
User interaction	None
Vulnerable system - Confidentiality impact	High
Vulnerable system - Integrity impact	None
Vulnerable system - Availability impact	Low
Subsequent system - Confidentiality impact	None
Subsequent system - Integrity impact	None
Subsequent system - Availability impact	None

Scores

Parameter	Value
Base score	8.3 · High
Base + Threat score	-
Base + Environmental score	-
Base + Threat + Environmental score	-

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Base score 8.2 · High

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	None
Availability impact	Low

Scores

Parameter	Value
Base score	8.2 · High
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

CVE-2026-77214

Cvss 3 Severity Score