# CVE-2024-8176: libexpat: Multiple issues in libexpat, including unexpected app termination or arbitrary code execution

CVE-2024-8176 is fixed in 18 products on 2 platforms, first by RHSA-2025:7512, released March 13, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-8176
- Priority: High
- CVSS: 7.5 (HIGH)
- EPSS: 0.0135
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Mar 13, 2025
- Vendor advisory: https://support.apple.com/en-us/122716

## Description

This is a vulnerability in open source code and Apple Software is among the affected projects. The

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| macOS | Sequoia | 15.5 | [Sequoia 15.5](https://patchblox.com/security/data/fix/macos/sequoia-15.5.md) | May 12, 2025 |
| macOS | Sonoma | 14.7.6 | [Sonoma 14.7.6](https://patchblox.com/security/data/fix/macos/sonoma-14.7.6.md) | May 12, 2025 |
| macOS | Ventura | 13.7.6 | [Ventura 13.7.6](https://patchblox.com/security/data/fix/macos/ventura-13.7.6.md) | May 12, 2025 |
| Linux | expat Debian 12.15 (bookworm) | 2.5.0-1+deb12u2 | [DEBIAN-CVE-2024-8176](https://patchblox.com/security/data/fix/linux/debian-cve-2024-8176.md) | Mar 14, 2025 |
| Linux | expat Debian 13.5 (trixie) | 2.7.0-1 | [DEBIAN-CVE-2024-8176](https://patchblox.com/security/data/fix/linux/debian-cve-2024-8176.md) | Mar 14, 2025 |
| Linux | expat Debian 14 | 2.7.0-1 | [DEBIAN-CVE-2024-8176](https://patchblox.com/security/data/fix/linux/debian-cve-2024-8176.md) | Mar 14, 2025 |
| Linux | expat RHEL 10 | 2.7.1-1.el10_0 | [RHSA-2025:7512](https://patchblox.com/security/data/fix/linux/rhsa-2025-7512.md) | Mar 13, 2025 |
| Linux | expat RHEL 8 | 0:2.2.5-17.el8_10 | [RHSA-2025:3913](https://patchblox.com/security/data/fix/linux/rhsa-2025-3913.md) | Apr 15, 2025 |
| Linux | expat RHEL 9 | 0:2.5.0-5.el9_6 | [RHSA-2025:7444](https://patchblox.com/security/data/fix/linux/rhsa-2025-7444.md) | May 13, 2025 |
| Linux | expat Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.6 | [expat 2.4.7-1ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-expat-2.4.7-1ubuntu0.6.md) | Mar 14, 2025 |
| Linux | expat Ubuntu 24.04.5 LTS (noble) | 2.6.1-2ubuntu0.3 | [expat 2.6.1-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-expat-2.6.1-2ubuntu0.3.md) | Mar 14, 2025 |
| Linux | expat Ubuntu 24.10 (oracular) | 2.6.2-2ubuntu0.2 | [expat 2.6.2-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-expat-2.6.2-2ubuntu0.2.md) | Jan 16, 2026 |
| Linux | expat Ubuntu 25.04 (plucky) | 2.7.1-1 | [expat 2.7.1-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-expat-2.7.1-1.md) | Jan 16, 2026 |
| Linux | expat Ubuntu 25.10 (questing) | 2.7.1-1 | [expat 2.7.1-1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-expat-2.7.1-1.md) | Mar 14, 2025 |
| Linux | expat almalinux 10 | 2.7.1-1.el10_0 | [ALSA-2025:7512](https://patchblox.com/security/data/fix/linux/alsa-2025-7512.md) | May 13, 2025 |
| Linux | expat almalinux 8 | 2.2.5-17.el8_10 | [ALSA-2025:3913](https://patchblox.com/security/data/fix/linux/alsa-2025-3913.md) | Apr 15, 2025 |
| Linux | expat almalinux 9 | 2.5.0-5.el9_6 | [ALSA-2025:7444](https://patchblox.com/security/data/fix/linux/alsa-2025-7444.md) | May 13, 2025 |
| Linux | expat ol 10 | 0:2.7.1-1.el10_0 | [ELSA-2025-7512](https://patchblox.com/security/data/fix/linux/elsa-2025-7512.md) | Jun 27, 2025 |
| Linux | expat ol 8 | 0:2.2.5-17.0.1.el8_10 | [ELSA-2025-3913](https://patchblox.com/security/data/fix/linux/elsa-2025-3913.md) | Apr 15, 2025 |
| Linux | expat ol 9 | 0:2.5.0-3.el9_5.3 | [ELSA-2025-3531](https://patchblox.com/security/data/fix/linux/elsa-2025-3531.md) | Apr 2, 2025 |
| Linux | expat opensuse-leap 15.6 | 2.7.1-150400.3.28.1 | [SUSE-SU-2025:1201-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-1201-1.md) | Apr 11, 2025 |
| Linux | expat rocky 10 | 0:2.7.1-1.el10_0 | [RLSA-2025:7512](https://patchblox.com/security/data/fix/linux/rlsa-2025-7512.md) | Oct 3, 2025 |
| Linux | expat rocky 8 | 0:2.2.5-17.el8_10 | [RLSA-2025:3913](https://patchblox.com/security/data/fix/linux/rlsa-2025-3913.md) | Jul 29, 2025 |
| Linux | expat rocky 9 | 0:2.5.0-3.el9_5.3 | [RLSA-2025:3531](https://patchblox.com/security/data/fix/linux/rlsa-2025-3531.md) | Jul 29, 2025 |
| Linux | expat sles 15.6 | 2.8.5-150400.3.40.1 | [SUSE-SU-2026:4623-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4623-1.md) | Nov 7, 2026 |
| Linux | expat sles 15.7 | 2.7.1-150700.3.3.1 | [SUSE-SU-2025:03239-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03239-1.md) | Sep 16, 2025 |
| Linux | expat-devel RHEL 8 | 0:2.2.5-17.el8_10 | [RHSA-2025:3913](https://patchblox.com/security/data/fix/linux/rhsa-2025-3913.md) | Apr 15, 2025 |
| Linux | expat-devel RHEL 9 | 0:2.5.0-5.el9_6 | [RHSA-2025:7444](https://patchblox.com/security/data/fix/linux/rhsa-2025-7444.md) | May 13, 2025 |
| Linux | expat-devel almalinux 10 | 2.7.1-1.el10_0 | [ALSA-2025:7512](https://patchblox.com/security/data/fix/linux/alsa-2025-7512.md) | May 13, 2025 |
| Linux | expat-devel almalinux 8 | 2.2.5-17.el8_10 | [ALSA-2025:3913](https://patchblox.com/security/data/fix/linux/alsa-2025-3913.md) | Apr 15, 2025 |
| Linux | expat-devel almalinux 9 | 2.5.0-5.el9_6 | [ALSA-2025:7444](https://patchblox.com/security/data/fix/linux/alsa-2025-7444.md) | May 13, 2025 |
| Linux | expat-devel ol 10 | 0:2.7.1-1.el10_0 | [ELSA-2025-7512](https://patchblox.com/security/data/fix/linux/elsa-2025-7512.md) | Jun 27, 2025 |
| Linux | expat-devel ol 8 | 0:2.2.5-17.0.1.el8_10 | [ELSA-2025-3913](https://patchblox.com/security/data/fix/linux/elsa-2025-3913.md) | Apr 15, 2025 |
| Linux | expat-devel ol 9 | 0:2.5.0-3.el9_5.3 | [ELSA-2025-3531](https://patchblox.com/security/data/fix/linux/elsa-2025-3531.md) | Apr 2, 2025 |
| Linux | libexpat1 Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.6 | [libexpat1 2.4.7-1ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libexpat1-2.4.7-1ubuntu0.6.md) | Mar 14, 2025 |
| Linux | libexpat1 Ubuntu 24.04.5 LTS (noble) | 2.6.1-2ubuntu0.3 | [libexpat1 2.6.1-2ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libexpat1-2.6.1-2ubuntu0.3.md) | Mar 14, 2025 |
| Linux | libexpat1 Ubuntu 24.10 (oracular) | 2.6.2-2ubuntu0.2 | [libexpat1 2.6.2-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libexpat1-2.6.2-2ubuntu0.2.md) | Jan 16, 2026 |
| Linux | libexpat1 Ubuntu 25.04 (plucky) | 2.7.1-1 | [libexpat1 2.7.1-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libexpat1-2.7.1-1.md) | Jan 16, 2026 |
| Linux | libexpat1 Ubuntu 25.10 (questing) | 2.7.1-1 | [libexpat1 2.7.1-1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libexpat1-2.7.1-1.md) | Mar 14, 2025 |
| Linux | xmlrpc-c RHEL 8 | 0:1.51.0-11.el8_10 | [RHSA-2025:4048](https://patchblox.com/security/data/fix/linux/rhsa-2025-4048.md) | Apr 23, 2025 |
| Linux | xmlrpc-c almalinux 8 | 1.51.0-11.el8_10 | [ALSA-2025:4048](https://patchblox.com/security/data/fix/linux/alsa-2025-4048.md) | Apr 22, 2025 |
| Linux | xmlrpc-c amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c ol 8 | 0:1.51.0-11.el8_10 | [ELSA-2025-4048](https://patchblox.com/security/data/fix/linux/elsa-2025-4048.md) | Apr 21, 2025 |
| Linux | xmlrpc-c rocky 8 | 0:1.51.0-11.el8_10 | [RLSA-2025:4048](https://patchblox.com/security/data/fix/linux/rlsa-2025-4048.md) | Jul 29, 2025 |
| Linux | xmlrpc-c-apps amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-apps-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-c++ RHEL 8 | 0:1.51.0-11.el8_10 | [RHSA-2025:4048](https://patchblox.com/security/data/fix/linux/rhsa-2025-4048.md) | Apr 23, 2025 |
| Linux | xmlrpc-c-c++ almalinux 8 | 1.51.0-11.el8_10 | [ALSA-2025:4048](https://patchblox.com/security/data/fix/linux/alsa-2025-4048.md) | Apr 22, 2025 |
| Linux | xmlrpc-c-c++ amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-c++ ol 8 | 0:1.51.0-11.el8_10 | [ELSA-2025-4048](https://patchblox.com/security/data/fix/linux/elsa-2025-4048.md) | Apr 21, 2025 |
| Linux | xmlrpc-c-c++-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-client RHEL 8 | 0:1.51.0-11.el8_10 | [RHSA-2025:4048](https://patchblox.com/security/data/fix/linux/rhsa-2025-4048.md) | Apr 23, 2025 |
| Linux | xmlrpc-c-client almalinux 8 | 1.51.0-11.el8_10 | [ALSA-2025:4048](https://patchblox.com/security/data/fix/linux/alsa-2025-4048.md) | Apr 22, 2025 |
| Linux | xmlrpc-c-client amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-client ol 8 | 0:1.51.0-11.el8_10 | [ELSA-2025-4048](https://patchblox.com/security/data/fix/linux/elsa-2025-4048.md) | Apr 21, 2025 |
| Linux | xmlrpc-c-client++ RHEL 8 | 0:1.51.0-11.el8_10 | [RHSA-2025:4048](https://patchblox.com/security/data/fix/linux/rhsa-2025-4048.md) | Apr 23, 2025 |
| Linux | xmlrpc-c-client++ almalinux 8 | 1.51.0-11.el8_10 | [ALSA-2025:4048](https://patchblox.com/security/data/fix/linux/alsa-2025-4048.md) | Apr 22, 2025 |
| Linux | xmlrpc-c-client++ amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-client++ ol 8 | 0:1.51.0-11.el8_10 | [ELSA-2025-4048](https://patchblox.com/security/data/fix/linux/elsa-2025-4048.md) | Apr 21, 2025 |
| Linux | xmlrpc-c-client++-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-client-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-debugsource amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-devel RHEL 8 | 0:1.51.0-11.el8_10 | [RHSA-2025:4048](https://patchblox.com/security/data/fix/linux/rhsa-2025-4048.md) | Apr 23, 2025 |
| Linux | xmlrpc-c-devel almalinux 8 | 1.51.0-11.el8_10 | [ALSA-2025:4048](https://patchblox.com/security/data/fix/linux/alsa-2025-4048.md) | Apr 22, 2025 |
| Linux | xmlrpc-c-devel amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 |
| Linux | xmlrpc-c-devel ol 8 | 0:1.51.0-11.el8_10 | [ELSA-2025-4048](https://patchblox.com/security/data/fix/linux/elsa-2025-4048.md) | Apr 21, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.