Libexpat Project

Libexpat is a compact, widely embedded XML parsing library that sits deep in the software supply chain across countless servers, applications, and systems despite maintaining a single product focus. Vulnerabilities affecting the library skew toward serious outcomes, with a notable share reaching critical severity, and their impact propagates to every downstream product that incorporates Libexpat, amplifying the practical importance of individual flaws. The recurring weakness classes—including integer overflows, improper XML external entity handling, buffer-boundary violations, XML entity expansion attacks, and NULL-pointer dereferences—reflect the parsing complexity and state-machine demands inherent to XML processing. Defenders should prioritize tracking products that bundle Libexpat rather than the library alone, since remediation often depends on downstream vendors rebuilding and releasing updates. Live severity, exploitation, and exposure counts are shown alongside this summary.