libexpat CVE-2026-118370

Exploitation requires the target application to parse attacker-controlled XML using a vulnerable libexpat (through 2.9.0), and the attacker must deliver a multi-gigabyte document whose single start tag carries more than 2^30 (~1 billion) attributes so that the signed int attIndex and nPrefixes counters in storeAtts() overflow into an out-of-bounds write. No authentication (PR:N) and no user interaction (UI:N) are needed. The practical limiting factors are the input scale itself: the attacker must transmit and have the victim ingest/parse a multi-GB payload with ~10^9 attributes, which consumes significant bandwidth, memory, and processing time (reflected as AC:H and AT:P) and may be blocked by request-size limits, input quotas, or resource caps in front of the parser.

The CVSS 4.0 base score of 8.2 (High) is tempered by two metrics that materially raise the exploitation bar: AC:H and AT:P. Per the description, triggering the signed integer overflow in storeAtts() requires supplying a multi-gigabyte XML document whose start tag carries more than 2^30 (~1 billion) attributes to overflow attIndex/nPrefixes - a precondition that demands substantial bandwidth, memory, and parsing time, which is consistent with the AC:H/AT:P scoring. The impact is scoped to availability only (VC:N/VI:N/VA:H); although the description mentions 'corrupting heap memory,' the vendor-aligned vector does not credit any confidentiality or integrity impact, so this is realistically a denial-of-service / crash issue rather than a demonstrated code-execution primitive. No EPSS score, KEV listing, or public exploit was provided in the input, and exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is this_week - notable because libexpat is ubiquitous (bundled in Python, countless language runtimes, browsers, and Linux distributions), giving an enormous attack surface, but the requirement to deliver a multi-GB payload with ~10^9 attributes argues against trivial, widespread automated exploitation. Net: a broadly deployed library with a credible DoS flaw, but the heavy input preconditions make this a prioritized-patch (this_week) rather than emergency item. Note the input provides a CVSS 4.0 vector only; no EPSS/KEV/PoC signals were supplied to compare against.

An attacker submits a specially crafted, multi-gigabyte XML document to a service that parses untrusted XML with a vulnerable libexpat (through 2.9.0). The document's start tag contains over 2^30 attributes, overflowing the signed int attIndex and nPrefixes counters in storeAtts(), which drives an out-of-bounds heap write and crashes or corrupts the parsing application. No authentication or user interaction is required (PR:N/UI:N), but the attacker must be able to deliver and have the target ingest a very large input (AC:H/AT:P); no public exploit was identified in the provided data.