The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8813-1 advisory.

    It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could     possibly use this issue to cause a denial of service.

    (CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)

    It was discovered that Expat did not correctly track handler call depth. An attacker could possibly use     this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56131)

    It was discovered that Expat did not correctly handle certain memory operations. An attacker could     possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56132)

    It was discovered that Expat did not correctly handle certain Unicode characters. An attacker could     possibly use this issue to cause Expat to use excessive resources, leading to a denial of service.
    (CVE-2026-72522)

    It was discovered that Expat did not correctly process certain XML attributes. A remote attacker could     possibly use this issue to cause Expat to use excessive resources, leading to a denial of service.
    (CVE-2026-66046)

    It was discovered that Expat did not correctly handle certain external entities. An attacker could     possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76641)

    It was discovered that Expat did not correctly track handler call depth with custom encodings. An attacker     could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76957)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Expat vulnerabilities (USN-8813-1)

high Nessus Plugin ID 350173

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Oct 26, 2026, 2:57 PM CVSS metrics ("Cvssv4 supplemental" set to "CVSS:4.0/U:Amber") Plugin Feed: 202610261457
Version 1.2 Sep 26, 2026, 2:30 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609260230
Version 1.1 Sep 25, 2026, 6:49 PM New Plugin Feed: 202609251849