FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

expat -- multiple vulnerabilities

Affected packages
		expat	<	2.7.4

Details

VuXML ID	027c6c07-065b-11f1-baae-589cfc023192
Discovery	2026-01-31
Entry	2026-02-10

expat team reports:

Update contains 2 security fixes:

CVE-2026-24515: NULL dereference in function XML_ExternalEntityParserCreate

CVE-2026-25210: missing check for integer overflow in function doContent

[source]

References

CVE Name	CVE-2026-24515
CVE Name	CVE-2026-25210