# OpenBSD patches two denial-of-service flaws in libexpat (CVE-2026-24515 and CVE-2026-25210)

- **Published on:** 2026-02-09
- **Category:** Security
- **Original page:** https://linuxgratis.com/en/articles/cve-2026-24515-libexpat-dos-openbsd

OpenBSD 7.7 and 7.8 ship errata 014 to fix a NULL pointer dereference and an integer overflow in libexpat that can cause denial of service when parsing XML.

---

On 9 February 2026 the OpenBSD project shipped a security patch as **errata 014** for OpenBSD 7.8, with a matching errata for 7.7. It fixes two denial-of-service vulnerabilities in **libexpat**, the XML parsing library also known as Expat. Both flaws were first addressed in **libexpat 2.7.4**, which project maintainer Sebastian Pipping released on 31 January 2026.

## What the vulnerabilities are

This patch covers two flaws:

- **CVE-2026-24515**: a **NULL pointer dereference** (CWE-476). The bug sits in the `XML_ExternalEntityParserCreate` function, which fails to copy the user data tied to the unknown-encoding handler. When a parent parser has an unknown-encoding handler registered with user data, the function creates a new parser to process external entities but never carries the user-data pointer over to the child parser. Once the handler runs with a NULL or uninitialized pointer, the application can crash.
- **CVE-2026-25210**: an **integer overflow** (CWE-190) in libexpat that can also end in a denial-of-service condition.

## Who is affected

This hits any program that uses libexpat to parse XML in versions **prior to 2.7.4**. Expat is one of the most widely deployed XML parsing libraries in free software, embedded across many languages, browsers and utilities. In this advisory, OpenBSD ships libexpat as part of the base system, so the errata fixes the component for every program that depends on it on **OpenBSD 7.7 and 7.8**.

## Severity

Severity is **low to medium**. The primary CVE, CVE-2026-24515, was assigned a very low CVSS v3.1 score (around 2.5-2.9, rated *low* by both NIST and MITRE), since it needs a local access vector, high attack complexity, and no privileges or user interaction in any trivial way. **The impact stops at availability**: the affected process terminates out of the blue when it processes crafted XML input. There is no code execution or data leakage tied to it, and nobody has seen it exploited in the wild. Still, if you run services that parse XML from untrusted sources, an availability failure matters.

## Mitigation and patch

The recommendation is straightforward: **upgrade libexpat to version 2.7.4 or later**. On OpenBSD you only need to apply the errata with the patch-update tool:

```sh
syspatch
```

The errata patches are available for the usual OpenBSD architectures. After applying them, restart any services linked against libexpat so they load the corrected library. On other distributions, install the updated `expat`/`libexpat` package that ships version 2.7.4.

If you want to see how OpenBSD hardens its base system against this class of bugs, take a look at the [OpenBSD](/en/openbsd) entry in our operating-system directory.

## Source

- Official advisory: [OpenBSD 7.8 Errata](https://www.openbsd.org/errata78.html)
- CVE detail: [CVE-2026-24515 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-24515)
- Related CVE: [CVE-2026-25210 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-25210)