Hi,

depends/libexpat points to DFHack/libexpat e3ea446, whose upstream base is libexpat 2691aff (expat 2.6.4, November 2024). The 53.16-r3 Linux release ships this code in hack/plugins/xlsxreader.plug.so, which reports "expat_2.6.4". The submodule on develop is the same.

xlsxreader opens .xlsx files through xlsxio, which feeds the sheet XML to expat with XML_ParseBuffer, so expat parses whatever spreadsheet a user loads, for example a quickfort blueprint downloaded from elsewhere.

expat releases since 2.6.4 fix issues that a crafted document can reach on this path, including:

• CVE-2024-8176, stack overflow from chaining many entities (fixed in 2.7.0)
• CVE-2025-59375, large memory allocations from a small document (2.7.2)
• CVE-2026-41080, too little salt entropy in the hash flooding protection (2.8.0)
• CVE-2026-45186, quadratic time in attribute name collision checks (2.8.1)
• CVE-2026-66046, quadratic time in attribute CDATA lookups (2.8.4)
• CVE-2026-93990, malformed UTF-16 accepted (2.8.5)

Later releases also add integer overflow checks for very large inputs. Updating depends/libexpat to expat 2.9.0 or later would pick all of these up. They are already public, and I have not tried to trigger any of them in DFHack.