libexpat 2.9.0 fixes two vulnerabilities, including a 32-bit integer overflow

On October 5, 2026, the oss-security list published a notice by Sebastian Pipping that libexpat version 2.9.0, released the same day, fixes two vulnerabilities. The changelog lists entry #1392 for CVE-2026-102633, an integer overflow in the expat_realloc function on 32-bit platforms, and entry #1393 for CVE-2026-77214, which concerns validation of the len parameter against the available buffer capacity in XML_ParseBuffer. The available text is an automatic translation and ends before other points, so it gives no severity rating, detailed impact or list of affected versions. libexpat is an XML parser used in many programs and systems. Rota Nacional does not patch third-party libraries and does not analyze these flaws. For teams running software that depends on libexpat, the practical action is to check the installed version and apply the update from the vendor or distribution. If your team uses AI to study the advisory, do not paste server names, logs, proprietary code or personal data. Rota applies a personal-data detection policy before any model runs, but that protection does not replace careful control of what you send. To verify the facts, consult the October 2026 oss-security archive and the official libexpat project changelog.