CVE-2026-117610

{
  "etk_id": "ETK-2026-2823",
  "cve_id": "CVE-2026-117610",
  "display_id": "CVE-2026-117610",
  "ghsa_id": "GHSA-v4h5-6r69-76p3",
  "euvd_id": "EUVD-2026-111545",
  "status": "published",
  "anchor_state": "anchored",
  "title": "NULL pointer dereference in libexpat XML parsing",
  "summary": "libexpat through 2.9.0 can crash while parsing an external entity because of a NULL pointer dereference. An attacker must be able to influence XML stream chunking and trigger processing through an external entity subparser.",
  "mitigation": "Restrict untrusted XML processing, especially external entity handling, and do not allow untrusted parties to control incremental input chunking. Monitor for and deploy an upstream release newer than 2.9.0 when one is available.",
  "vendor": "libexpat",
  "product": "libexpat",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.9.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "libexpat",
      "purl": null
    }
  ],
  "cwes": [
    476
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.502278533333333,
  "t0_at": "2026-10-28T02:03:18.766000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T02:03:18.766000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T02:03:18.766000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117610"
    }
  }
}