CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

2.01% chance of exploitation in the next 30 days, 79th percentile

Published

2024-03-10

Updated

2025-11-04

Proof-of-concept exploits (2)

• RenukaSelvar/expat_CVE-2024-287570★ · 2024-05-03
• saurabh2088/expat_2_1_0_CVE-2024-287570★ · 2024-05-03

References

• CVE Record
• NVD entry

Related

• CVE-2015-3239
• CVE-2020-24370
• CVE-2022-20140
• CVE-2023-1077
• CVE-2023-40127
• CVE-2015-0205