NexaPulse
Subscribe
2.9lowLow

CVE-2026-45186

Libexpat Project Libexpat

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

Exploitation status

  • Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
  • A vendor advisory or patch reference has been published.

What the metrics mean

  • It is requires local access to the machine.
  • For an attacker who can reach it, exploitation depends on conditions outside the attacker's control.
  • To exploit it, no account is needed.
  • Beyond that, no action by a user is required.

Scoring

CVSS
2.9 (v3.1)
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-407
Assigned by
cve@mitre.org

Dates

Published
2026-05-10
Last modified
2026-08-25
Sources
NVD

Affected products

  • Libexpat Project Libexpat- 2.8.1

As listed in the NVD configuration data. Not a statement about your estate.

References