CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

2.01% chance of exploitation in the next 30 days, 81st percentile

Published

2024-03-10

Updated

2026-10-15

Proof-of-concept exploits (2)

• RenukaSelvar/expat_CVE-2024-287570★ · 2024-05-03
• saurabh2088/expat_2_1_0_CVE-2024-287570★ · 2024-05-03

Security advisories

• https://security.netapp.com/advisory/ntap-20240322-0001
• http://www.openwall.com/lists/oss-security/2024/03/15/1
• libexpat/libexpat/issues/839

References

• CVE Record
• NVD entry

Related

• CVE-2015-3239
• CVE-2020-24370
• CVE-2022-20140
• CVE-2023-1077
• CVE-2023-40127
• CVE-2015-0205