CVE-2026-24515 | libexpat up to 2.7.3 XML_ExternalEntityParserCreate null pointer dereference

A vulnerability was found in libexpat up to 2.7.3 and classified as problematic. Affected is the function XML_ExternalEntityParserCreate. The manipulation results in null pointer dereference.

This vulnerability was named CVE-2026-24515. The attack needs to be approached locally. There is no available exploit.

It is suggested to upgrade the affected component.