Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-4224

28
FAUCET Score

CVE-2026-4224 identifies a C stack overflow vulnerability within the Expat XML parser, triggered by processing deeply nested inline document type definitions. While no specific affected products are officially listed, applications using the Expat library could be susceptible. Rated Medium severity (CVSS 6.0), this issue allows a remote attacker with low privileges to cause a denial of service with low complexity and no user interaction. There is currently no evidence of active exploitation, public exploit code, or significant community attention, with a very low EPSS score reflecting its low exploitability probability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 0, < 3.15.0CPE match
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
< 3.10.0CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.13.0, < 3.13.13CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
>= 3.14.0, < 3.14.4CPE matchmatch criteria
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
3.15.0CPE matchmatch criteria
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

6.0MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.62%
Probability of exploitation in next 30 days
EPSS Percentile
46.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0062 is in the 23rd percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 20937-17086Fixed in: 3.9.19-21
microsoftpatch availablevia msrc
Product: cbl2 python3 3.9.19-19 on CBL Mariner 2.0Fixed in: 3.9.19-21
ubuntupatch availablevia ubuntu_usn
Product: python3.10 (jammy)Fixed in: 3.10.12-1~22.04.16
ubuntupatch availablevia ubuntu_usn
Product: python3.12 (noble)Fixed in: 3.12.3-1ubuntu0.15
ubuntupatch availablevia ubuntu_usn
Product: python3.14 (resolute)Fixed in: 3.14.4-1ubuntu0.1

Vendor Advisories (2)

ubuntuUSN-8509-1

Python vulnerabilities

Jul 6, 2026
microsoft2026-Mar/CVE-2026-4224Moderate

Stack overflow parsing XML with deeply nested DTD content models

Mar 10, 2026

References

openwall.com / lists/oss-security/2026/03/16/4
Mailing ListThird Party Advisory
github.com / python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a
Patch
github.com / python/cpython/commit/642865ddf4b232da1f3b1f7abcfa3254c4bfe785
Patch
github.com / python/cpython/commit/af856a7177326ac25d9f66cc6dd28b554d914fee
Patch
github.com / python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3
Patch
github.com / python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768
Patch
github.com / python/cpython/issues/145986
Issue Tracking
github.com / python/cpython/pull/145987
Patch
mail.python.org / archives/list/[email protected]/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R
Third Party Advisory