Is CVE-2026-117610 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-117610?

CVE-2026-117610 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-117610

Description

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.