CVE-2026-124317
4.8 MEDIUMpublic exploit availablePublished 2026-11-07 · Updated 2026-11-11
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Weaknesses
CWE-126
Public exploit & PoC references
All references
- https://github.com/libexpat/libexpat
- https://github.com/libexpat/libexpat/blob/a70841d9ffa64ddde29ab824ed6305035ebe4c47/expat/lib/xmltok.c#L1274-L1322
- https://github.com/libexpat/libexpat/pull/1492
- https://www.vulncheck.com/advisories/libexpat-through-2.10.0-out-of-bounds-read-via-unknown-toutf8-and-unknown-toutf16
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- LOWCVE-2026-101094
- LOWCVE-2026-101130
- HIGHCVE-2026-101310
- HIGHCVE-2026-102728PoC
- HIGHCVE-2026-102758PoC
- MEDIUMCVE-2026-103567
- MEDIUMCVE-2026-105506
- HIGHCVE-2026-105515
Related by shared AI tags and CWE weakness class. Browse the full archive.