7.5

CVE-2026-45186: libexpat_project libexpat Inefficient Algorithmic Complexity

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2026-45186MGASA-2026-0204RHSA-2026:22715
Published 10-05-2026Last modified 15-10-2026
Open JSON

Vulnerability summary

CVE-2026-45186 is a high (CVSS 7.5) Inefficient Algorithmic Complexity vulnerability in libexpat_project libexpat. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.48%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 13 · Related 14
OPENSUSE-SU-2026:10787-1OPENSUSE-SU-2026:11747-1OPENSUSE-SU-2026:11756-1OPENSUSE-SU-2026:21945-1SUSE-SU-2026:23743-1SUSE-SU-2026:23894-1

Timeline

  1. 10-05-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

+0.02 pp

From 0.46% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Libexpat

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Ubuntu16 products
  • ayttmAll versions (No fix recorded)
  • cableswigAll versions (No fix recorded)
  • cadaverAll versions (No fix recorded)
  • coin3All versions (No fix recorded)
  • expatAll versions (No fix recorded) | < 2.6.1-2ubuntu0.5 | < 2.7.4-1ubuntu0.1
Redhat5 products
  • expat< 0:2.7.3-1.el10_2.1 | < 0:2.5.0-2.el8_10 | < 0:2.5.0-6.el9_8.1 | < 0:2.8.5-1.1.hum1
  • expat-debuginfo< 0:2.7.3-1.el10_2.1 | < 0:2.5.0-2.el8_10 | < 0:2.5.0-6.el9_8.1
  • expat-debugsource< 0:2.7.3-1.el10_2.1 | < 0:2.5.0-2.el8_10 | < 0:2.5.0-6.el9_8.1
  • expat-devel< 0:2.7.3-1.el10_2.1 | < 0:2.5.0-2.el8_10 | < 0:2.5.0-6.el9_8.1 | < 0:2.8.5-1.1.hum1
  • expat-static< 0:2.8.5-1.1.hum1
Alpine1 product
  • expat< 2.8.1-r0
Chainguard1 product
  • expat< 2.8.1-r0
Debian1 product
  • expat< 2.5.0-1+deb12u4 | < 2.8.2-1~deb13u1 | < 2.8.0-2
Libexpat_project1 product
Mageia1 product
  • expat< 2.7.5-1.1.mga9
Wolfi1 product
  • expat< 2.8.1-r0

8 vendors · 27 products

References

33 links
Show all 33 references