AZL-112841
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112841.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-112841
- Upstream
- Published
- 2026-11-07T15:17:16Z
- Modified
- 2026-11-08T14:16:24Z
- Summary
- CVE-2026-124317 affecting package expat 2.9.0-1
- Details
-
libexpat through 2.10.0 contains an out-of-bounds read vulnerability in unknown_toUtf8() and unknown_toUtf16() in xmltok.c when handling application-registered unknown encodings. Attackers can supply a document ending in a truncated multibyte sequence so the convert callback reads past the parse buffer, leaking adjacent memory or crashing applications.
- References