StanFromIreland · Nov 2, 2026 · Nov 2, 2026 · Nov 2, 2026
@@ -659,6 +659,7 @@ LIBEXPAT_OBJS= \
 LIBEXPAT_HEADERS= \
 		Modules/expat/ascii.h \
 		Modules/expat/asciitab.h \
+		Modules/expat/entities.h \
 		Modules/expat/expat.h \
 		Modules/expat/expat_config.h \
 		Modules/expat/expat_external.h \

diff --git a/Misc/NEWS.d/next/Security/2026-11-02-18-30-09.gh-issue-161192.2ScSRO.rst b/Misc/NEWS.d/next/Security/2026-11-02-18-30-09.gh-issue-161192.2ScSRO.rst
@@ -0,0 +1,3 @@
+Update bundled `libexpat <https://libexpat.github.io/>`_ to version 2.10.0
+for the fixes to :cve:`2026-113351`, :cve:`2026-115506`, :cve:`2026-117610`
+and :cve:`2026-118370`.
diff --git a/Modules/expat/ascii.h b/Modules/expat/ascii.h
@@ -10,7 +10,7 @@
    Copyright (c) 2000      Clark Cooper <coopercc@users.sourceforge.net>
    Copyright (c) 2002      Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2007      Karl Waclawek <karl@waclawek.net>
-   Copyright (c) 2017      Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -113,6 +113,7 @@
 #define ASCII_LT 0x3C
 #define ASCII_EQUALS 0x3D
 #define ASCII_GT 0x3E
+#define ASCII_QUEST 0x3F
 #define ASCII_LSQB 0x5B
 #define ASCII_RSQB 0x5D
 #define ASCII_UNDERSCORE 0x5F

diff --git a/Modules/expat/entities.h b/Modules/expat/entities.h
@@ -0,0 +1,99 @@
+/* Internal helpers related to entities
+                            __  __            _
+                         ___\ \/ /_ __   __ _| |_
+                        / _ \\  /| '_ \ / _` | __|
+                       |  __//  \| |_) | (_| | |_
+                        \___/_/\_\ .__/ \__,_|\__|
+                                 |_| XML parser
+
+   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
+   Licensed under the MIT license:
+
+   Permission is  hereby granted,  free of charge,  to any  person obtaining
+   a  copy  of  this  software   and  associated  documentation  files  (the
+   "Software"),  to  deal in  the  Software  without restriction,  including
+   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+   distribute, sublicense, and/or sell copies of the Software, and to permit
+   persons  to whom  the Software  is  furnished to  do so,  subject to  the
+   following conditions:
+
+   The above copyright  notice and this permission notice  shall be included
+   in all copies or substantial portions of the Software.
+
+   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+   USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+   SPDX-License-Identifier: MIT
+*/
+
+#if ! defined(EXPAT_ENTITIES_H)
+#  define EXPAT_ENTITIES_H 1
+
+#  include "expat_config.h"   // for XML_GE
+#  include "expat_external.h" // for XML_Char
+#  include "internal.h"       // for XML_NONTESTING_STATIC
+#  include <stdbool.h>        // for size_t
+#  include <stddef.h>         // for size_t
+
+typedef struct {
+  const XML_Char *name;
+  const XML_Char *textPtr;
+  size_t textLen;   /* length in XML_Chars */
+  size_t processed; /* # of processed bytes - when suspended */
+  const XML_Char *systemId;
+  const XML_Char *base;
+  const XML_Char *publicId;
+  const XML_Char *notation;
+  bool open;
+  bool hasMore; /* true if entity has not been completely processed */
+  /* An entity can be open while being already completely processed (!hasMore).
+    The reason is the delayed closing of entities until their inner
+    entities are processed and closed */
+  bool is_param;
+  bool is_internal; /* true if declared in internal subset outside PE */
+#  if XML_GE == 1
+  /* Indirect accounting bytes charged when this entity is expanded: 1 per text
+     character, plus each reference's "&name;"/"%name;" token length and its own
+     expansion. Matches XML_ACCOUNT_ENTITY_EXPANSION, so it is not the
+     replacement-text size. 0 means "not computed yet" (an empty entity is 0
+     too, told apart by textLen == 0). */
+  XmlBigCount expandedSize;
+  bool beingAnalyzed; /* on the resolveEntityClosureExpandedSize depth-first
+                             search stack; used for cycle detection */
+  const XML_Char
+      *scanPtr; /* cursor position into the entity's replacement text; NULL when
+                   `textPtr` is NULL, else a pointer into the entity value,
+                   ranging from `.textPtr` to `.textPtr + .textLen`. */
+#  endif        /* XML_GE == 1 */
+} ENTITY;
+
+#  if XML_GE == 1
+/* How a scanEntityText call ended. */
+enum EntityScanResult {
+  ENTITY_SCAN_COMPLETE, /* reached end of text; *expandedSize is final */
+  ENTITY_SCAN_BLOCKED,  /* stopped at a defined entity whose expanded
+                           size has not been computed yet; *blockerOut
+                           names the entity whose size to compute
+                           first */
+  ENTITY_SCAN_OVERFLOW  /* the expanded size would exceed XmlBigCount;
+                           callers must abort parsing */
+};
+
+XML_NONTESTING_STATIC int isCDataCommentOrPIStart(const XML_Char *pos,
+                                                  size_t maxLen,
+                                                  size_t *openTextLen);
+
+XML_NONTESTING_STATIC int isPredefinedEntityName(const XML_Char *name,
+                                                 size_t nameLen);
+
+XML_NONTESTING_STATIC enum EntityScanResult
+scanEntityText(XML_Parser parser, ENTITY *entity, const XML_Char **posPtr,
+               XmlBigCount *expandedSize, ENTITY **blockerOut);
+#  endif /* XML_GE == 1 */
+
+#endif // ! defined(EXPAT_ENTITIES_H)
diff --git a/Modules/expat/expat.h b/Modules/expat/expat.h
@@ -21,6 +21,7 @@
    Copyright (c) 2024      Taichi Haradaguchi <20001722@ymail.ne.jp>
    Copyright (c) 2025      Matthew Fernandez <matthew.fernandez@gmail.com>
    Copyright (c) 2026      Braian Plaku <braianplaku@gmail.com>
+   Copyright (c) 2026      Xisco Fauli <xiscofauli@libreoffice.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -1084,7 +1085,7 @@ enum XML_Parser_Property {
 #  if defined(XML_TESTING)
   XML_PROP_INVALID = 0,
 #  endif
-#  if XML_GE == 1
+#  if defined(XML_GE) && XML_GE == 1
   XML_PROP_ALLOC_TRACKER_ACTIVATION_THRESHOLD = 1,   // of type `uint64_t`
   XML_PROP_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION = 2,  // of type `double`
   XML_PROP_BILLION_LAUGHS_ACTIVATION_THRESHOLD = 3,  // of type `uint64_t`
@@ -1146,7 +1147,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
    See https://semver.org
 */
 #  define XML_MAJOR_VERSION 2
-#  define XML_MINOR_VERSION 9
+#  define XML_MINOR_VERSION 10
 #  define XML_MICRO_VERSION 0
 
 #  ifdef __cplusplus

diff --git a/Modules/expat/expat_external.h b/Modules/expat/expat_external.h
@@ -12,7 +12,7 @@
    Copyright (c) 2001-2002 Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2016      Cristian Rodríguez <crrodriguez@opensuse.org>
-   Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
    Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>

diff --git a/Modules/expat/internal.h b/Modules/expat/internal.h
@@ -29,6 +29,7 @@
    Copyright (c) 2026      Matthew Wozniczka <mattheww@simba.com>
    Copyright (c) 2026      Braian Plaku <braianplaku@gmail.com>
    Copyright (c) 2026      Florian Schmaus <florian.schmaus@codasip.com>
+   Copyright (c) 2026      Brooks Davis <brooks@one-eyed-alien.net>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -90,11 +91,10 @@
 #      define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
 #    endif
 #  else
-#    include <inttypes.h> // PRIdPTR, PRIuPTR
 #    define EXPAT_FMT_LLX(midpart) "%" midpart "llx"
 #    define EXPAT_FMT_ULL(midpart) "%" midpart "llu"
-#    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart PRIdPTR
-#    define EXPAT_FMT_SIZE_T(midpart) "%" midpart PRIuPTR
+#    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "td"
+#    define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu"
 #  endif
 
 #  ifndef UNUSED_P
@@ -127,6 +127,8 @@ union expat_align {
 
 #  include "expat.h" // so we can use type XML_Parser below
 
+typedef unsigned long long XmlBigCount;
+
 void _INTERNAL_trim_to_complete_utf8_characters(const char *from,
                                                 const char **fromLimRef);
 

diff --git a/Modules/expat/refresh.sh b/Modules/expat/refresh.sh
@@ -12,9 +12,9 @@ fi
 
 # Update this when updating to a new version after verifying that the changes
 # the update brings in are good. These values are used for verifying the SBOM, too.
-expected_libexpat_tag="R_2_9_0"
-expected_libexpat_version="2.9.0"
-expected_libexpat_sha256="16afbb9cefead2aa278105cf27d9f597bde7fbf3dbb85015857ca7ca6a4e89ba"
+expected_libexpat_tag="R_2_10_0"
+expected_libexpat_version="2.10.0"
+expected_libexpat_sha256="5466a341f9c692ef7a958a6881311be597f8e1ce345984cf78414f54793dea4c"
 
 expat_dir="$(realpath "$(dirname -- "${BASH_SOURCE[0]}")")"
 cd ${expat_dir}
@@ -31,6 +31,7 @@ declare -a lib_files
 lib_files=(
   ascii.h
   asciitab.h
+  entities.h
   expat.h
   expat_external.h
   fallthrough.h