🛡️ CVE-2026-24515 on BellSoft — expat

Distribution advisory

This page covers CVE-2026-24515 as tracked by BellSoft, for the package expat. The fix is available in version 2.7.3-r1; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability low.

Weakness class

BELL-CVE-2026-24515 is classified as CWE-476: NULL Pointer Dereference. A pointer that can be null is used without a check, crashing the process.

Affected software

BELL-CVE-2026-24515 is recorded against 1 package.

• expat (from 2.4.9-r0 up to 2.7.3-r1)

Timeline and source

Published on 28 January 2026 and last revised on 7 February 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

docs.bell-sw.com (Advisory)

CVE-2026-24515 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Affected Packages

References