CVE-2026-32776: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-32776 is a NULL pointer dereference vulnerability (CWE-476) in libexpat, the widely-used C library for XML parsing. A remote attacker can trigger a crash by supplying specially crafted XML content containing empty external parameter entities, resulting in a Denial of Service (DoS). All libexpat versions before 2.7.5 are affected; the fix was released on March 17, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) per Red Hat's assessment, with a local attack vector (Red Hat CVE, libexpat PR #1158).

The root cause lies in how libexpat handles external parameter entities with empty content (CWE-476). When such an entity is referenced inside an entity declaration value, a sub-parser is created that receives 0 bytes of input. Processing enters entityValueInitProcessor, which calls storeEntityValue() using the parser's encoding; because no bytes have been processed, encoding detection has not occurred and the encoding remains the initial probing encoding set by XmlInitEncoding(). This probing encoding only populates scanners[] (for prolog and content) but not literalScanners[]. When XmlEntityValueTok() subsequently calls through literalScanners[XML_ENTITY_VALUE_LITERAL], the pointer is NULL, causing a segmentation fault (SEGV). The fix skips the tokenization loop entirely when entityTextPtr >= entityTextEnd and initializes the next pointer before the early exit so callers receive a valid value (libexpat PR #1158).

Successful exploitation causes the application using libexpat to crash, resulting in a Denial of Service. Because libexpat is embedded in a wide range of software — including Python, Firefox, IBM AIX, IBM HTTP Server, Splunk, and various Linux distributions — the blast radius extends to any application that parses untrusted XML. There is no confidentiality or integrity impact; the sole consequence is availability loss (Red Hat CVE, IBM Advisory).

1. Identify target: Locate an application that uses a vulnerable version of libexpat (< 2.7.5) and accepts XML input from untrusted sources — for example, a web service, document processor, or network daemon.
2. Craft malicious XML: Construct an XML document that declares an external parameter entity with empty content and references it inside another entity declaration value, e.g.:

<!DOCTYPE foo [
  <!ENTITY % ext SYSTEM "empty.xml">
  <!ENTITY % wrapper "%ext;">
]>
<foo/>

where empty.xml is an empty or zero-byte file served from an attacker-controlled server. 3. Deliver the payload: Submit the crafted XML to the target application via its normal input channel (HTTP request body, file upload, API call, etc.). 4. Trigger crash: The libexpat sub-parser processes the empty external parameter entity, dereferences the NULL literalScanners[XML_ENTITY_VALUE_LITERAL] pointer, and the application crashes with a segmentation fault, achieving DoS (libexpat PR #1158).

• Logs: Application crash logs or core dumps referencing a segmentation fault (SIGSEGV) within libexpat functions such as XmlEntityValueTok, storeEntityValue, or entityValueInitProcessor.
• Process: Unexpected termination or restart of XML-processing services (e.g., web servers, document parsers) without a clear operational cause.
• Network: Inbound requests delivering XML payloads that reference external parameter entities pointing to attacker-controlled or empty resources; unusual outbound HTTP/HTTPS connections from the XML-processing service to fetch external DTD/entity files.
• File System: Presence of core dump files (e.g., core, core.<pid>) in application working directories following service crashes.

Upgrade libexpat to version 2.7.5 or later, released on March 17, 2026, which contains the fix for this vulnerability (libexpat PR #1159). Downstream consumers should apply vendor-specific updates: Microsoft has issued patches for Azure Linux 3 expat packages, IBM has released fixes for AIX and IBM HTTP Server, and major Linux distributions (SUSE, openSUSE, Amazon Linux 2, Slackware, OpenBSD, Mageia) have published updated packages (Microsoft MSRC, IBM Advisory). As a workaround where patching is not immediately possible, restrict or sanitize XML input to prevent the use of external parameter entities (e.g., disable external entity resolution at the application layer).

The vulnerability was discovered and reported by contributor frabert via a pull request to the libexpat GitHub repository on March 5, 2026, with the CVE assigned by Mitre on March 16, 2026 (libexpat PR #1158). Multiple Linux distributions and vendors including SUSE, openSUSE, Amazon Linux, IBM, Microsoft, Splunk, OpenBSD, and the Yocto Project issued advisories and updated packages in the weeks following disclosure, reflecting the library's broad adoption. Community coverage was largely routine, consistent with a medium-severity DoS-only vulnerability with no active exploitation.