libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 12:18:30 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in– |
AI-suggested
Users should monitor vendor communications for updates and consider applying any forthcoming patches once available.
Description
A denial of service vulnerability exists in libexpat through version 2.9.0 related to delayed detection of the Billion Laughs attack pattern. This vulnerability can cause the software to become unresponsive or crash when processing specially crafted XML input. The affected version explicitly noted is version 3.0 of the Microsoft product referencing libexpat. No CVSS score or detailed impact metrics are provided.
Impact
The impact is a denial of service condition where the affected software may become unresponsive or crash due to resource exhaustion triggered by maliciously crafted XML input exploiting the Billion Laughs attack pattern. There is no evidence of active exploitation in the wild or additional impact such as code execution.
Summary
The vulnerability identified as CVE-2026-115506 affects libexpat through version 2.9.0 and involves a denial of service condition caused by delayed detection of the Billion Laughs attack, a known XML entity expansion attack. The Microsoft product version 3.0 is affected. The vulnerability allows an attacker to cause resource exhaustion by exploiting the delayed detection mechanism, potentially leading to application unavailability. No patch or remediation details are provided in the available data.
Weaknesses
- CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (opens in a new tab)
Base weaknessLikelihood of exploit: MediumOWASP Top 10 A02:2025: Security Misconfiguration (opens in a new tab)
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.