CVE-2026-24515
Fixed in a distro release EPSS <1%CVSS 2.9
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
Products: libexpat_project libexpat, Siemens RUGGEDCOM RST2428P
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.20 | expat | 2.7.4-r0 |
| Alpine 3.21 | expat | 2.7.4-r0 |
| Alpine 3.22 | expat | 2.7.4-r0 |
| Alpine 3.23 | expat | 2.7.4-r0 |
| Alpine 3.24 | expat | 2.7.4-r0 |
| Chainguard | expat | 2.7.4-r0 |
| Debian 12 | expat | 2.5.0-1+deb12u4 |
| Debian 13 | expat | 2.8.2-1~deb13u1 |
| Debian 14 | expat | 2.7.3-2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.2 | expat | 2.7.1-150000.3.42.1 |
| SUSE Linux Enterprise Micro 5.3 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.3 | expat | 2.7.1-150400.3.34.1 |
| SUSE Linux Enterprise Micro 5.4 | expat | 2.7.1-150400.3.34.1 |
| SUSE Linux Enterprise Micro 5.4 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.5 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.5 | expat | 2.7.1-150400.3.34.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | expat | 2.8.5-150700.3.15.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | expat | 2.7.1-150700.3.9.2 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | expat | 2.8.5-21.55.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 16.0 | expat | 2.7.1-160000.4.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | expat | 2.7.1-21.49.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | expat | 2.8.5-21.55.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | expat | 2.7.1-160000.4.1 |
| SUSE Linux Micro 6.0 | expat | 2.7.1-4.1 |
| SUSE Linux Micro 6.1 | expat | 2.7.1-slfo.1.1_4.1 |
| SUSE Linux Micro 6.2 | expat | 2.7.1-160000.4.1 |
| Ubuntu 16.04 LTS | cadaver | no fix |
| Ubuntu 16.04 LTS | gdcm | no fix |
| Ubuntu 16.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 16.04 LTS | matanza | no fix |
| Ubuntu 16.04 LTS | smart | no fix |
| Ubuntu 16.04 LTS | tdom | no fix |
| Ubuntu 16.04 LTS | wbxml2 | no fix |
| Ubuntu 18.04 LTS | cadaver | no fix |
| Ubuntu 18.04 LTS | gdcm | no fix |
| Ubuntu 18.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 18.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | smart | no fix |
| Ubuntu 18.04 LTS | tdom | no fix |
| Ubuntu 18.04 LTS | vnc4 | no fix |
| Ubuntu 18.04 LTS | wbxml2 | no fix |
| Ubuntu 20.04 LTS | cadaver | no fix |
| Ubuntu 20.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 20.04 LTS | matanza | no fix |
| Ubuntu 20.04 LTS | tdom | no fix |
| Ubuntu 20.04 LTS | wbxml2 | no fix |
| Ubuntu 22.04 LTS | cadaver | no fix |
| Ubuntu 22.04 LTS | expat | 2.4.7-1ubuntu0.7 |
| Ubuntu 22.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 22.04 LTS | matanza | no fix |
| Ubuntu 22.04 LTS | tdom | no fix |
| Ubuntu 22.04 LTS | wbxml2 | no fix |
| Ubuntu 24.04 LTS | cadaver | no fix |
| Ubuntu 24.04 LTS | expat | 2.6.1-2ubuntu0.4 |
| Ubuntu 24.04 LTS | matanza | no fix |
| Ubuntu 24.04 LTS | tdom | no fix |
| Ubuntu 24.04 LTS | wbxml2 | no fix |
| Ubuntu 25.10 | cadaver | no fix |
| Ubuntu 25.10 | expat | 2.7.1-2ubuntu0.2 |
| Ubuntu 25.10 | matanza | no fix |
| Ubuntu 25.10 | swish-e | no fix |
| Ubuntu 25.10 | tdom | no fix |
| Ubuntu 25.10 | wbxml2 | no fix |
| Ubuntu 25.10 | xmlrpc-c | no fix |
| Ubuntu 26.04 LTS | cadaver | no fix |
| Ubuntu 26.04 LTS | matanza | no fix |
| Ubuntu 26.04 LTS | tdom | no fix |
| Ubuntu 26.04 LTS | wbxml2 | no fix |
| Ubuntu 26.04 LTS | xmlrpc-c | no fix |
| Ubuntu 26.10 | cadaver | no fix |
| Ubuntu 26.10 | matanza | no fix |
| Ubuntu 26.10 | swish-e | no fix |
| Ubuntu 26.10 | tdom | no fix |
| Ubuntu 26.10 | wbxml2 | no fix |
| Ubuntu 26.10 | xmlrpc-c | no fix |
| Ubuntu Pro 14.04 LTS | coin3 | no fix |
| Ubuntu Pro 14.04 LTS | expat | 2.1.0-4ubuntu1.4+esm11 |
| Ubuntu Pro 14.04 LTS | vnc4 | no fix |
| Ubuntu Pro 14.04 LTS | vtk | no fix |
| Ubuntu Pro 14.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 16.04 LTS | ayttm | no fix |
| Ubuntu Pro 16.04 LTS | cableswig | no fix |
| Ubuntu Pro 16.04 LTS | coin3 | no fix |
| Ubuntu Pro 16.04 LTS | expat | 2.1.0-7ubuntu0.16.04.5+esm11 |
| Ubuntu Pro 16.04 LTS | libxmltok | 1.2-3ubuntu0.16.04.1~esm5 |
| Ubuntu Pro 16.04 LTS | swish-e | no fix |
| Ubuntu Pro 16.04 LTS | vnc4 | no fix |
| Ubuntu Pro 16.04 LTS | vtk | no fix |
| Ubuntu Pro 16.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 18.04 LTS | coin3 | no fix |
| Ubuntu Pro 18.04 LTS | expat | 2.2.5-3ubuntu0.9+esm3 |
| Ubuntu Pro 18.04 LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm6 |
| Ubuntu Pro 18.04 LTS | swish-e | no fix |
| Ubuntu Pro 18.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 20.04 LTS | expat | 2.2.9-1ubuntu0.8+esm1 |
| Ubuntu Pro 20.04 LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm6 |
| Ubuntu Pro 20.04 LTS | swish-e | no fix |
| Ubuntu Pro 20.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 22.04 LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm6 |
| Ubuntu Pro 22.04 LTS | swish-e | no fix |
| Ubuntu Pro 22.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 24.04 LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm4 |
| Ubuntu Pro 24.04 LTS | swish-e | no fix |
| Ubuntu Pro 24.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 26.04 LTS | swish-e | no fix |
| Wolfi | expat | 2.7.4-r0 |
| openSUSE Leap 15.6 | expat | 2.7.1-150400.3.34.1 |
| openSUSE Leap 16.0 | expat | 2.7.1-160000.4.1 |
| openSUSE Tumbleweed | expat | 2.7.4-1.1 |