CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier...

Security readout for executives and security teams

This CVE concerns Expat XML parser behavior where missing or zero hash salt can make hash randomization easier to predict. In affected contexts, an attacker may be able to weaken protections that depend on unpredictable hashing. The provided sources do not include CVSS, affected version ranges, or confirmed active exploitation. Exposure is most likely where applications, operating systems, or embedded products include Expat and parse XML from untrusted or semi-trusted sources. The source bundle does not identify specific affected versions or CPEs, so inventory and vendor advisories are required. Treat this as an inventory and patch-management item, not an emergency unless critical systems parse untrusted XML with vulnerable Expat behavior. The absence of CVSS and KEV evidence lowers certainty, but Expat is commonly embedded and should be checked. Mitigation focus: Check Expat, OS, and platform vendor advisories for supported fixes.; Update affected Expat packages through trusted vendor channels.; Inventory applications and products that parse XML using Expat..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.