CVE-2026-32776

MEDIUM

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.

CVSS v3.1 Score

4.0
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
Published: 3/16/2026Modified: 7/14/2026

Related Intelligence (1)

CRITICALVulnerability

Hitachi Energy RTU500

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-155-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. If exploited, these vulnerabilities primarily impact product availability, with potential secondary impacts on confidentiality and

CVE-2025-69421CVE-2026-24515
CISA Advisories

References (3)

https://github.com/libexpat/libexpat/pull/1158Issue TrackingPatchhttps://github.com/libexpat/libexpat/pull/1159Issue TrackingPatchhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html