CVE-2026-117610

What it actually does

NULL pointer dereference in externalEntityInitProcessor2() triggered by mishandling XML_TOK_NONE from an empty non-final chunk on an external entity subparser, resulting in application crash.

Why it matters to the business

Attackers can remotely crash services that parse untrusted XML, leading to denial of service and potential operational disruption until the affected processes are restarted.

How an attack unfolds

An attacker who controls how XML input is chunked sends a stream that forces an empty first parse on an external entity subparser followed by a subsequent parse, causing the NULL dereference and crash.

How to fix it

Upgrade libexpat to a version newer than 2.9.0 once a fix is released; in the interim, restrict or sanitize untrusted XML input and disable external entity processing where feasible.

How to confirm the fix worked

Confirm the installed libexpat version exceeds 2.9.0, re-test parsing of chunked external-entity XML under the conditions described in the advisory, and verify the application no longer crashes.

Typical attack path

1. Identify a target application that uses libexpat to parse XML containing external entities
2. Craft a malicious XML stream and deliver it in controlled chunks
3. Force an empty non-final first parse on the external entity subparser
4. Trigger a follow-on parse that dereferences the NULL pointer and crashes the process

How to detect it

Review application and system logs for unexpected crashes or segmentation faults during XML parsing; correlate with inbound network traffic containing XML payloads delivered in multiple small chunks.

What your security team should do

• Monitor upstream libexpat releases and apply the patch immediately upon availability
• Inventory all software using libexpat and prioritize updates for internet-facing services
• Implement input validation and external entity restrictions as temporary controls