NULL Pointer Dereference Vulnerability in Expat Package (CVE-2026-32778)
Summary
ALPINE-CVE-2026-32778: libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. Affects expat versions < 2.7.5-r0. Fixed in 2.7.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Expat is an XML parsing library that is widely used in various software applications for its efficiency and ease of use. It provides a simple API for parsing XML documents and is known for its performance and reliability. However, prior to version 2.7.5, Expat is susceptible to a NULL pointer dereference vulnerability that can occur during error handling, particularly after an out-of-memory condition.
Vulnerability Detail
The vulnerability identified as CVE-2026-32778 allows for a NULL pointer dereference in the function setContext when the library attempts to retry after encountering an out-of-memory condition. This flaw can lead to application crashes or unexpected behavior, potentially exposing systems to denial-of-service attacks. The issue arises from improper handling of memory allocation failures, which can leave the application in an unstable state.
How To Fix
Minimum fixed version
2.7.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade expatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider implementing additional error handling in your application to manage memory allocation failures more gracefully. However, the best approach is to update to the patched version of the Expat library.
Conclusion
The CVE-2026-32778 vulnerability in the Expat package poses a risk of NULL pointer dereference, which can lead to application instability. It is crucial to update to version 2.7.5 or later to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for expat →
FAQ
CVE-2026-32778 is a vulnerability in the Expat XML parsing library that allows for a NULL pointer dereference, potentially leading to application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Expat versions prior to 2.7.5 are affected by this vulnerability.
The CVSS score for CVE-2026-32778 is 5.5, indicating a moderate severity level.
If immediate updates are not possible, consider implementing additional error handling to manage memory allocation failures until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for expat.
