diff --git a/meta/recipes-core/expat/expat/CVE-2026-117610.patch b/meta/recipes-core/expat/expat/CVE-2026-117610.patch
new file mode 100644
index 0000000000..5843b4ac85
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-117610.patch
@@ -0,0 +1,30 @@
+From 731159c29d2df0f98ba3a4c61e4bf5d0075acb63 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Mon, 26 Oct 2026 17:39:32 +0100
+Subject: [PATCH] lib: Fix initial non-final empty subparser call with a
+ handler
+
+CVE: CVE-2026-117610
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/pull/1444/commits/bfc28346fa3efeb8ca56c17437d24a7344e5feab]
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+
+---
+ lib/xmlparse.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index cb8839be..75c3a806 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3227,6 +3227,11 @@ externalEntityInitProcessor2(XML_Parser parser, const char *start,
+     }
+     parser->m_eventPtr = start;
+     return XML_ERROR_PARTIAL_CHAR;
++  case XML_TOK_NONE:
++    if (! parser->m_parsingStatus.finalBuffer) {
++      *endPtr = start;
++    }
++    return XML_ERROR_NONE;
+   }
+   parser->m_processor = externalEntityInitProcessor3;
+   return externalEntityInitProcessor3(parser, start, end, endPtr);
diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.3.bb
index 6d08a3fd94..1e7e4e0e5d 100644
--- a/meta/recipes-core/expat/expat_2.8.3.bb
+++ b/meta/recipes-core/expat/expat_2.8.3.bb
@@ -18,6 +18,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
            file://CVE-2026-76957-02.patch \
            file://CVE-2026-93990-01.patch \
            file://CVE-2026-93990-02.patch \
+           file://CVE-2026-117610.patch \
            "
 
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"