{"id":"SUSE-SU-2026:24460-1","summary":"Security update for expat","details":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","modified":"2026-11-02T17:23:09.756312758Z","published":"2026-10-27T16:12:58Z","related":["CVE-2026-102633","CVE-2026-32776","CVE-2026-32777","CVE-2026-32778","CVE-2026-56403","CVE-2026-56404","CVE-2026-56405","CVE-2026-77214","CVE-2026-93990"],"upstream":["CVE-2026-102633","CVE-2026-32776","CVE-2026-32777","CVE-2026-32778","CVE-2026-56403","CVE-2026-56404","CVE-2026-56405","CVE-2026-77214","CVE-2026-93990"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624460-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1275115"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282347"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283493"},{"type":"REPORT","url":"https://bugzilla.suse.com/1284334"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-102633"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32776"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32777"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-32778"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56403"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56404"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56405"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-77214"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93990"}],"affected":[{"package":{"name":"expat","ecosystem":"SUSE:Linux Micro 6.2","purl":"pkg:rpm/suse/expat&distro=SUSE%20Linux%20Micro%206.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"libexpat1":"2.8.5-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24460-1.json"}}],"schema_version":"1.9.2"}