CVE-2026-32778: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-32778 is a NULL pointer dereference vulnerability in libexpat (the Expat XML parsing library) affecting all versions before 2.7.5. The flaw exists in the setContext function, where a failed poolCopyString() call during an out-of-memory condition leaves a PREFIX hash table entry with a NULL name pointer; a subsequent retry then dereferences that NULL pointer, causing a Denial of Service (DoS). It was disclosed on March 16, 2026, with a fix merged the same day and released in libexpat 2.7.5 on March 17, 2026. The CVSS v3.1 base score is 5.5 (Medium) per NVD, though ENISA rates it 2.9 (Low) under a higher-complexity vector (Red Hat CVE, GitHub PR #1163).

The root cause is a NULL pointer dereference (CWE-476) in libexpat's setContext() function. During XML namespace prefix resolution, lookup() creates a PREFIX entry in the hash table before poolCopyString() copies the prefix name into the memory pool. If poolCopyString() fails due to an out-of-memory (OOM) condition, the entry is left with name = NULL — a "zombie" entry. Because the parser remains in XML_INITIALIZED state, a retry invocation calls keyeq() on this zombie entry, dereferencing the NULL pointer and crashing the application. The fix, contributed by researcher "Laserbear," copies the prefix name to dtd->pool before the lookup() call, preventing zombie entries from being created (GitHub PR #1163). The attack vector is local, requiring low privileges, with no user interaction needed (Red Hat CVE).

Successful exploitation causes a Denial of Service (DoS) for any application that uses libexpat for XML parsing, crashing the affected process. There is no impact on confidentiality or integrity — only availability is affected. Given libexpat's widespread use as a dependency in system libraries, browsers, Python, and other software, the blast radius can extend to any application on the affected host that relies on the library (Red Hat CVE, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term. Exploitation requires local access and the ability to trigger specific out-of-memory conditions followed by a retry operation, making opportunistic exploitation unlikely (GitHub PR #1163).

The primary remediation is to upgrade libexpat to version 2.7.5 or later, which was released on March 17, 2026, and contains the fix via GitHub Pull Requests #1163 and #1159. Downstream distributions including SUSE, openSUSE, Amazon Linux 2, Slackware, OpenBSD, and Mageia have issued updated packages. IBM has released patches for AIX and related products. For systems that cannot be patched immediately, limiting local user access and monitoring for unusual memory pressure conditions that could trigger OOM scenarios can reduce risk (GitHub PR #1159, IBM Advisory, Microsoft MSRC).

Red Hat, Microsoft, IBM, SUSE, Amazon, OpenBSD, and Splunk all issued advisories or updated packages in response to this vulnerability, reflecting its broad reach as a widely-used XML parsing library (Red Hat CVE, IBM Advisory, Microsoft MSRC). The Yocto Project and OpenEmbedded communities also tracked and patched the issue in their respective build systems. Community reaction has been measured given the low severity and absence of known exploitation.