Medium severity4.8NVD Advisory· Published Nov 7, 2026· Updated Nov 7, 2026

CVE-2026-124317

Description

libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libexpat Project/Libexpatllm-fuzzy
Range: <=2.10.0

Patches

Vulnerability mechanics

References

github.com/libexpat/libexpat/blob/a70841d9ffa64ddde29ab824ed6305035ebe4c47/expat/lib/xmltok.cnvd
github.com/libexpat/libexpat/pull/1492nvd
www.vulncheck.com/advisories/libexpat-through-2.10.0-out-of-bounds-read-via-unknown-toutf8-and-unknown-toutf16nvd

News mentions

No linked articles in our index yet.

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000