Ubuntu Security Notices
USN-8813-1

USN-8813-1: Expat vulnerabilities

Publication date

24 September 2026

Overview

Expat could be made to crash or run programs if it received specially crafted input.

Releases

26.04 LTS 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS 14.04 LTS

Packages

expat - XML parsing C library

Details

It was discovered that Expat did not correctly handle certain integer
arithmetic. An attacker could possibly use this issue to cause a denial of
service.
(CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)

It was discovered that Expat did not correctly track handler call depth. An
attacker could possibly use this issue to cause Expat to crash or execute
arbitrary code. (CVE-2026-56131)

It was discovered that Expat did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause Expat to
crash or execute arbitrary code. (CVE-2026-56132)

It was discovered that Expat did not correctly handle certain...

It was discovered that Expat did not correctly track handler call depth. An
attacker could possibly use this issue to cause Expat to crash or execute
arbitrary code. (CVE-2026-56131)

It was discovered that Expat did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause Expat to
crash or execute arbitrary code. (CVE-2026-56132)

It was discovered that Expat did not correctly handle certain Unicode
characters. An attacker could possibly use this issue to cause Expat to use
excessive resources, leading to a denial of service. (CVE-2026-72522)

It was discovered that Expat did not correctly process certain XML
attributes. A remote attacker could possibly use this issue to cause Expat
to use excessive resources, leading to a denial of service.
(CVE-2026-66046)

It was discovered that Expat did not correctly handle certain external
entities. An attacker could possibly use this issue to cause Expat to crash
or execute arbitrary code. (CVE-2026-76641)

It was discovered that Expat did not correctly track handler call depth
with custom encodings. An attacker could possibly use this issue to cause
Expat to crash or execute arbitrary code. (CVE-2026-76957)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
26.04 LTS resolute	expat – 2.7.4-1ubuntu0.2
	libexpat1 – 2.7.4-1ubuntu0.2
	libexpat1-dev – 2.7.4-1ubuntu0.2
24.04 LTS noble	expat – 2.6.1-2ubuntu0.6
	libexpat1 – 2.6.1-2ubuntu0.6
	libexpat1-dev – 2.6.1-2ubuntu0.6
22.04 LTS jammy	expat – 2.4.7-1ubuntu0.9
	libexpat1 – 2.4.7-1ubuntu0.9
	libexpat1-dev – 2.4.7-1ubuntu0.9
20.04 LTS focal	expat – 2.2.9-1ubuntu0.8+esm3
	libexpat1 – 2.2.9-1ubuntu0.8+esm3
	libexpat1-dev – 2.2.9-1ubuntu0.8+esm3
18.04 LTS bionic	expat – 2.2.5-3ubuntu0.9+esm5
	libexpat1 – 2.2.5-3ubuntu0.9+esm5
	libexpat1-dev – 2.2.5-3ubuntu0.9+esm5
16.04 LTS xenial	expat – 2.1.0-7ubuntu0.16.04.5+esm14
	lib64expat1 – 2.1.0-7ubuntu0.16.04.5+esm14
	lib64expat1-dev – 2.1.0-7ubuntu0.16.04.5+esm14
	libexpat1 – 2.1.0-7ubuntu0.16.04.5+esm14
	libexpat1-dev – 2.1.0-7ubuntu0.16.04.5+esm14
14.04 LTS trusty	expat – 2.1.0-4ubuntu1.4+esm13
	lib64expat1 – 2.1.0-4ubuntu1.4+esm13
	lib64expat1-dev – 2.1.0-4ubuntu1.4+esm13
	libexpat1 – 2.1.0-4ubuntu1.4+esm13
	libexpat1-dev – 2.1.0-4ubuntu1.4+esm13

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

USN-8813-1: Expat vulnerabilities

Packages

Details

Update instructions

Reduce your security exposure

References