CVE-2026-24515: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-24515 is a NULL Pointer Dereference vulnerability in libexpat (the Expat XML parsing library) where XML_ExternalEntityParserCreate fails to copy unknown encoding handler user data to subparsers. It affects all versions of libexpat before 2.7.4. The vulnerability was assigned on January 23, 2026, with the fix merged the same day and targeted for the 2.7.4 release. It carries a CVSS v3.1 base score of 2.5 (Low) per NVD's reassessment, and 2.9 (Low) per MITRE (GitHub PR, NVD).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When an application uses both XML_SetUnknownEncodingHandler (to register a custom encoding handler with associated user data) and XML_ExternalEntityParserCreate (to create a subparser for external entities), the subparser does not inherit the unknown encoding handler's user data pointer. This results in a NULL pointer being passed where valid user data is expected, which can trigger a dereference fault during XML parsing of external entities with unknown encodings. Exploitation requires an attacker to supply a crafted XML document that triggers external entity parsing with an unknown encoding, and the application must use both of the aforementioned API functions (GitHub PR, NVD).

Successful exploitation results in a limited availability impact — specifically, a potential crash or denial of service of the parsing process — with no confidentiality or integrity impact. The scope is unchanged and confined to the affected process, meaning lateral movement or data exfiltration are not direct consequences of this vulnerability. The impact is constrained to applications that use both XML_ExternalEntityParserCreate and XML_SetUnknownEncodingHandler with non-NULL user data, limiting the affected population (NVD, GitHub PR).

There is no known public exploit code, active in-the-wild exploitation, or threat actor attribution for CVE-2026-24515. The EPSS score is extremely low at 0.000040, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, high attack complexity, and a specific application configuration using both affected API functions, making opportunistic exploitation unlikely (NVD, Feedly).

The fix is included in libexpat version 2.7.4, released in late January 2026, which makes XML_ExternalEntityParserCreate properly copy the unknown encoding handler user data to subparsers. Administrators and developers should upgrade libexpat to 2.7.4 or later. Downstream distributions including Ubuntu (USN-8022-1, USN-8023-1), SUSE, Mageia, OpenBSD, Fedora, and FreeBSD have issued updated packages. Python releases 3.10.20, 3.11.15, and 3.12.13 also incorporate the fix for their bundled expat (GitHub PR, Expat Blog, Python Downloads).

Initial NVD analysis incorrectly scored CVE-2026-24515 as Critical (CVSS 9.8), which caused confusion in the community; NVD subsequently corrected the score to 2.5 (Low) after reanalysis on February 5, 2026. Community members on the GitHub PR noted the discrepancy and confirmed the corrected low severity. The vulnerability received broad downstream attention due to libexpat's widespread use, prompting rapid patching across Linux distributions, Python, OpenBSD, Splunk, Dell, Siemens, and Hitachi Energy products (GitHub PR, Siemens Advisory).