These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE record for CVE-2026-76957 was published on 2026-08-20T05:16:29.747Z. The vulnerability affects libexpat versions before 2.8.4, which lacks handler call depth tracking with custom encoding callbacks, leading to a use-after-free vulnerability. This issue has a CVSS score of 4.9, classified as MEDIUM severity. Developers and administrators using affected versions should be aware of this vulnerability [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T05:16:29.610Z and has not been modified since then. The vulnerability affects libexpat versions 2.8.2 and 2.8.3, which are susceptible to hash flooding attacks due to misinterpretation of getentropy's return code, leading to insufficient entropy. This results in a denial of service via crafted XM [truncated]
A denial of service vulnerability exists in Expat through version 2.8.3. The storeAtts() function in xmlparse.c has a quadratic algorithmic complexity that can be triggered by processing N specified attributes with non-normalized values in an XML document. This can cause excessive CPU consumption, leading to a denial of service. A remote, unauthenticated attacker can exploit this by supplying a single wel [truncated]
CVE-2026-56411 is a medium-severity vulnerability (CVSS score of 6.9) affecting libexpat before version 2.8.2. The issue is an integer overflow in the endDoctypeDecl function, which occurs via NOTATION declarations. This vulnerability could potentially allow local attackers with specific conditions to execute arbitrary code. The disclosure date is June 21, 2026, and defenders should prioritize patching or [truncated]
CVE-2026-56410 is an integer overflow vulnerability in xmlwf in libexpat before 2.8.2. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM. This issue affects systems using xmlwf, particularly in parsing XML content. The vulnerability's impact is localized, requiring local access and specific conditions to be exploited, but it can lead to high impacts on confidentiality, integrity, and l [truncated]
CVE-2026-56409 is a MEDIUM severity vulnerability in libexpat before 2.8.2. The issue involves an integer overflow in the xmlwf utility when the -d outputDir option is used. This vulnerability could potentially allow local attackers with specific conditions to cause high impact on confidentiality and integrity, and low impact on availability. The CVSS score is 6.5. The vulnerability was published on June [truncated]
CVE-2026-56408 is a medium-severity integer overflow vulnerability in libexpat before 2.8.2. The issue arises in the copyString function. Affected systems may face local attacks with high complexity, requiring no privileges or user interaction. Successful exploitation could lead to high impacts on confidentiality, integrity, and low impact on availability. Defenders should assess their exposure, focusing [truncated]
CVE-2026-56407 is a medium-severity vulnerability in libexpat before 2.8.2. The issue is an integer overflow in doProlog related to storeEntityValue and entity textLen. This vulnerability has a CVSS score of 6.9. Affected systems may face potential risks if the library is used in a manner that allows an attacker to trigger the overflow. The priority posture for this vulnerability is medium, given its pote [truncated]
CVE-2026-56406 is an integer overflow vulnerability in libexpat before 2.8.2. The vulnerability occurs in the XML_ParseBuffer function, which lacked a check present in XML_Parse. This CVE has a CVSS score of 6.9 and a MEDIUM severity. Affected systems may be vulnerable to potential attacks if they use the vulnerable version of libexpat. The priority posture for this CVE is MEDIUM.
CVE-2026-56403 is a medium severity vulnerability in libexpat before version 2.8.2. The issue is an integer overflow in the storeAtts function. This vulnerability has a CVSS score of 6.9. Affected systems and applications using libexpat versions prior to 2.8.2 are at risk. The vulnerability was published on June 21, 2026, and no later modifications were recorded on the same day. The primary concern for de [truncated]
CVE-2026-32778 is a medium-severity vulnerability in Hitachi Energy's RTU500 series CMU Firmware. The vulnerability is caused by a NULL pointer dereference in the function setContext on retry after an earlier out-of-memory condition in libexpat before 2.7.5. This results in a Denial of Service impact. The product is only affected if IEC 61850 functionality is configured. According to the CISA advisory, IC [truncated]
CVE-2026-32777 is a medium-severity vulnerability in libexpat before version 2.7.5, which allows an infinite loop while parsing DTD content, causing a Denial of Service impact. The vulnerability affects Hitachi Energy's RTU500 series CMU Firmware if IEC 61850 functionality is configured. The vulnerability was published on May 26, 2026, and modified on June 4, 2026. The CVSS score is 5.5, and the severity is MEDIUM.
CVE-2026-45186 is a low-severity denial-of-service issue in libexpat before 2.8.1. According to the CVE description, the problem is a computational-complexity weakness in attribute name collision checks, which can let crafted XML input consume excessive processing time and disrupt availability.
CVE-2026-41080 is a vulnerability in libexpat, a popular XML parsing library. The issue arises from the library's use of insufficient entropy, making it vulnerable to hash flooding attacks via crafted XML documents. This CVE was published on 2026-04-16 and modified on 2026-06-12.
