CVE-2026-4224

When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs.

Credits

Gil Portnoy
Stan Ulbrych
Bénédikt Tran
Stan Ulbrych

References