Hi,

The following vulnerability was published for expat.

CVE-2026-102633[0]:
| libexpat versions 2.7.2 through 2.8.5 contain an integer overflow
| vulnerability in expat_realloc() function on 32-bit platforms when
| computing allocation sizes. Attackers supplying malicious XML to
| applications parsing with vulnerable libexpat can cause heap buffer
| overflow, memory corruption, or denial of service.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-102633
https://www.cve.org/CVERecord?id=CVE-2026-102633
[1] https://github.com/libexpat/libexpat/pull/1392

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
expat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149507@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated expat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 30 Sep 2026 16:38:52 +0200
Source: expat
Architecture: source
Version: 2.8.5-2
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Closes: 1149507
Changes:
 expat (2.8.5-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-102633: replace assert with runtime
     overflow check in expat_realloc (closes: #1149507).
Checksums-Sha1:
 b8759af9dc461ea300df57779c9a8863caa2edca 1970 expat_2.8.5-2.dsc
 45bf4a9a1b04743425c7d83fac61747905e0305f 15168 expat_2.8.5-2.debian.tar.xz
Checksums-Sha256:
 1093b599a1245827eca68383371a3b3a1991fd3c7f9537506e4e557a3c0523d4 1970 expat_2.8.5-2.dsc
 1c4354bc84ba14b4269e72e41192655c1d0df48a661c6362d4349e0133ee67a5 15168 expat_2.8.5-2.debian.tar.xz
Files:
 b37f4f5c55fc5bc9b60361b097c68e46 1970 text optional expat_2.8.5-2.dsc
 73b388d08f40e4909673d55ed1af038d 15168 text optional expat_2.8.5-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmq9IjAACgkQ3OMQ54ZM
yL+/yw//ddf79Ga86AIJV+JDM5h8vbvbFJViAItvrIsNFOHphejtJUySzDPAJvGu
du+QcM1nyrC3hh8n0BY05bk87DZbVC2zuF0GQWwx0ADbjkElQ758Z0VrgcWUr4Ov
9VmY3txnGzGbT52drsrF6k9eIM0gMIGBA9GWZH9coxKiNfEALGhdEXXNgrGUJ2PU
BbUWwKHNGtxdpGoc8bxO1gYw9CsGws6yCSi70dh3/qtj6Nv9ZfRFBg2u9L9PYpan
3f6KmQUqgvNw+oRInK6EFDmZjQV9YPPBwmsC/eKNbRQhmzJ+9Nirg1fCmAHOOTd2
cRpxp0kJZpMuAZ4PkeM64rOihxohQJrQ/1h3RnwwkJ/IABxmp0OH00JmKZA2wA2F
wHCQaXsWjd/zcYnFpce1fsqCzPLMWKi8L563heJSnXEvu/IKVjeEqQy8AWc/MD9C
Xixf1r/rD0acjKC0eNkqfKdJ6wd3l2b13re69PR33qlzCHGh71WsSclgbQNFTqMK
yMpMMiRizSnDZkh/PuxeS5fgWpTmBiTI7944QNMD3gaIokfyUvama7P+OKzqXrJC
qeQoYirtn1s5Ezj/JWeGVWyzaSli6mQdhCvrmQqooQIbf3xB/pA5fNdKU1EzlYeN
cgQ9OlSl3+4p+SaCEY4jxUKbMGYTf/mkfMA3N5eyE4ji/SMSGE4=
=3rMz
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
expat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149507@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated expat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 11 Oct 2026 15:25:11 +0200
Source: expat
Architecture: source
Version: 2.9.0-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1148665 1149507
Changes:
 expat (2.9.0-1~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Rebuild for trixie-security
 .
 expat (2.9.0-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-77214: validate parameter len against available buffer
       capacity in XML_ParseBuffer(),
     - fixes CVE-2026-102633: integer overflow in function expat_realloc()
       on 32bit platforms.
   * Update libexpat1 symbols.
 .
 expat (2.8.5-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-102633: replace assert with runtime
     overflow check in expat_realloc (closes: #1149507).
 .
 expat (2.8.5-1) unstable; urgency=medium
 .
   * New upstream release.
 .
 expat (2.8.4-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-93990: fails to validate low
     surrogates following high surrogates in UTF-16 input (closes: #1148665).
 .
 expat (2.8.4-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-66046 and CVE-2026-76641: fix quadratic runtime from
       "attribute isCdata lookups" that allowed denial of service attacks,
     - fixes CVE-2026-76957: protect custom encoding callbacks from parser
       re-entry,
     - fixes CVE-2026-76956: fix inverted getentropy() return handling.
Checksums-Sha1:
 941b0a4b27d13c82ba355981912b42236503bfd0 2157 expat_2.9.0-1~deb13u1.dsc
 757c277106dfab05e1ad895d31ed63c82b438c04 8488503 expat_2.9.0.orig.tar.gz
 b7fc0d435cc0ca3f0ab63ccd687848e4f6ebcf77 14348 expat_2.9.0-1~deb13u1.debian.tar.xz
 1e540318bfeb63b90ed5c2ef5591167e66527f88 5269 expat_2.9.0-1~deb13u1_source.buildinfo
Checksums-Sha256:
 09fe168e2186a2672e077d9fda02287b51fa08f73914fcc425b3307b503df8ff 2157 expat_2.9.0-1~deb13u1.dsc
 6e8ce7b52ebbaa423c59becc7cf1e6875c42e49228c062ac8123c10e700cec27 8488503 expat_2.9.0.orig.tar.gz
 0c1575a3dc3d039f9e6751821efcdfd5246e04c6af4939defa01226d94541fba 14348 expat_2.9.0-1~deb13u1.debian.tar.xz
 557af304e95c3ed8a494c4d843397ca4b6afcdfd3e0bb55b322404a4f71f7c02 5269 expat_2.9.0-1~deb13u1_source.buildinfo
Files:
 8b93d6a8e28ab8fa25b0df2de5e6f792 2157 text optional expat_2.9.0-1~deb13u1.dsc
 a33aef07840ad21397f99299e43b033a 8488503 text optional expat_2.9.0.orig.tar.gz
 2f0a17ecfd0a8acbc5a4fd47052b81b3 14348 text optional expat_2.9.0-1~deb13u1.debian.tar.xz
 c2e7798c92da7f5cee94f0e19d52ee90 5269 text optional expat_2.9.0-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrNTBVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EL1cP/3xzGnnYB6bX2TqTrD4p5nK8QGBr5Xhf
Qdoat7+GnLLYWNKVmfh+EV6kBqd3RpTwbEHYqnh0RW34rvGEGQMZe2douJmD5lG7
NyRa0QNFzU65p0KGLPNWFR9eRBS2mIR5wAAvcroP2lgmBfyo3cd8QzsrEXUUjF3+
2cD2/98qroE4g6CWWD27V/9Y8zOP4t8k7/2QM5er21h5eDiBg/+YKy23gvMfM7xM
0uFbiDfRzhTZsrofjh/02u+ELi4KZVNtFXLKf4D+vqP52D5NNDV5jDXRfT41B3jK
jltuHuYLEXROW/OpZEsbYE9KTAAzi7gdymdj+3KViJbYd7pMimyN84o3nXuy2Fte
JsqEcsDnqWb60EdcE0muUtcqmRtwv1j0gcfvrKfv5/nT73PVrdlcVfEWJxznZXJ1
oLz95AT0NIK/+wBj01IgAGKeI/3dPOnZ00Kt3yz8VWNRfCntJEMf1ONpHBKrgMlu
VoXz41jr88nhEopQPffebdVuSt06/witz/SxFgvatkSG1Oxg+1aEGe2EGdq9t5vz
lHp7yhqNMbwypMr7nhhm/iH6eEjojlzkigbgNED2Lk6GKYk6mY40tC4/4xgFksHm
CwwpGDe8chgSGf7NcfMljv7Nzl4Nk3Cdx1H4eiol3KcTZP+hjE7pcdFHfXuRmiIU
gaPrz5fj/FK/
=HA4W
-----END PGP SIGNATURE-----