CVE-2026-76641 is a regression introduced by the fix for CVE-2026-66046. That prior patch altered ELEMENT_TYPE struct members in a way that created a size mismatch, which propagates through storeAtts into an out-of-bounds attIndex read. The trigger specificity — XML_ExternalEntityParserCreate — matters because external entity parsers fork state from a parent parser, inheriting struct copies. If ELEMENT_TYPE's size changed between parent and child contexts, attIndex member alignment differs, causing storeAtts to read past buffer boundaries.
The dual impact vector is the critical analytical point: depending on heap state at the time of the out-of-bounds read, an attacker triggers either whitespace normalization failure or a wild pointer dereference. Denial of service via segfault is deterministic; memory disclosure requires favorable heap layout. This ambiguity should inform severity assessment — CVSS 7.5 likely underweights the practical DOS impact for Expat-based services.
The regression pattern reveals a systematic weakness: when CVE-2026-66046 modified ELEMENT_TYPE's internal layout, there was no tooling to enumerate which functions depend on struct internals or validate downstream memory layout coherence across parser instantiation hierarchies. This isn't a patch validation failure — it's a structural consequence of how C struct dependencies are managed under real development conditions. The fix for CVE-2026-66046 was applied at the struct definition level without adequate testing of downstream effects on parser state machines that depend on that struct's internal layout.
Two concrete things defenders should examine. First, verify whether your deployment uses XML_ExternalEntityParserCreate with non-CDATA attributes — that's the narrow but reliable DOS trigger path. Second, audit your dependency chain: Expat embeds transitively into libxml2 wrappers, language runtimes, and container base images. The actual blast radius extends into systems you may not directly control.
The temporal dimension complicates exposure assessment. Organizations that patched CVE-2026-66046 quickly were also the first to run code containing CVE-2026-76641's struct modification. Fast remediators got hit first — delayed patching may have ironically provided a narrower window of dual exposure. This inverts standard patching assumptions and means your exposure window is layered, not linear.
Expect regression tests for CVE-2026-76641 to document the symptom (external entity parsers shouldn't trigger out-of-bounds reads) without documenting why ELEMENT_TYPE's internal layout matters to attIndex alignment across parser forks. That's negative documentation — the next developer modifying that struct inherits a test suite that says 'don't break external entity parsers' without understanding the constraint. Treat every struct layout change as a semver-breaking event requiring API compatibility review across inheritance chains, not just immediate consumers.