CVE-2024-28757 libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting XML Libraries Published on February 18, 2026 Two new Common Vulnerabilities and Exposures (CVEs) were published on February 18, 2026. CVE-2022-49043 affects libxml2 versions before 2.11.0, introducing a use-after-free vulnerability, while CVE-2024-28757 in libexpat versions up to 2.6.1 allows for XML Entity Expansion attacks when using external parsers. Both vulnerabilities could impact applications relying on these libraries for XML processing. 8 sources 41

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)