{"id":"CVE-2026-124317","published":"2026-11-07T15:17:16.080","lastModified":"2026-11-11T05:19:36.560","description":"libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.","cvssScore":4.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","cwes":["CWE-126"],"vendors":[],"products":[],"references":[{"url":"https://github.com/libexpat/libexpat","tags":[]},{"url":"https://github.com/libexpat/libexpat/blob/a70841d9ffa64ddde29ab824ed6305035ebe4c47/expat/lib/xmltok.c#L1274-L1322","tags":[]},{"url":"https://github.com/libexpat/libexpat/pull/1492","tags":[]},{"url":"https://www.vulncheck.com/advisories/libexpat-through-2.10.0-out-of-bounds-read-via-unknown-toutf8-and-unknown-toutf16","tags":[]}],"exploitRefs":[{"url":"https://github.com/libexpat/libexpat","tags":[]},{"url":"https://github.com/libexpat/libexpat/blob/a70841d9ffa64ddde29ab824ed6305035ebe4c47/expat/lib/xmltok.c#L1274-L1322","tags":[]},{"url":"https://github.com/libexpat/libexpat/pull/1492","tags":[]}],"hasPoc":true,"ai":null}