CVE-2017-11742: The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows al...

Security readout for executives and security teams

This is a Windows-specific libexpat weakness where affected versions may load a malicious ADVAPI32.DLL from the current working directory. A local attacker could use that DLL search-path behavior to gain higher privileges. The public record does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely where Windows applications bundle or dynamically load Expat 2.2.1 or 2.2.2 and run from attacker-writable working directories. The source bundle does not identify downstream products or CPEs, so inventory is required. Treat this as a targeted local privilege risk, not an internet-scale emergency based on the provided evidence. Prioritize Windows systems running affected Expat versions in privileged or multi-user contexts, especially where applications start from writable locations. Mitigation focus: Inventory Windows software that includes or loads libexpat.; Check whether Expat 2.2.1 or 2.2.2 is present.; Review libexpat vendor guidance and update to a non-affected version where applicable..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.