libexpat CVE-2026-56132

Exploitation requires two concurrent conditions, both of which must be present: (1) The application must have external entity parameter parsing explicitly enabled via XML_SetParamEntityParsing with either XML_PARAM_ENTITY_PARSING_ALWAYS or XML_PARAM_ENTITY_PARSING_UNLESS_STANDALONE - this is NOT enabled by default in libexpat, meaning the application developer must have affirmatively opted into this behavior; (2) The attacker-controlled XML input must contain a DTD with deeply nested element content model declarations (the upstream test case uses 64+ levels of recursive grouping) sufficient to trigger multiple scaffold array reallocations, combined with a parameter entity reference that causes libexpat to create an external entity sub-parser that inherits the parent DTD's scaffIndex. Factors that LIMIT exploitation: external entity parsing is off by default and is frequently disabled in security-hardened builds and public-facing XML processors precisely to prevent entity-based attacks; AC:H reflects that crafting the exact nesting depth to trigger misaligned reallocation is non-trivial; AV:L in the provided CVSS suggests that standard usage ties the external entity to a local file path, meaning that attacker delivery may require influence over local file system state or the application's entity resolver implementation; no privilege on the target system is required from the attacker's perspective (PR:N).

The CVSS 6.9 Medium vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L warrants careful interpretation. AC:H accurately reflects that two non-trivial conditions must align: deeply nested DTD element content model declarations (the test case uses 64+ nesting levels to force multiple scaffold reallocations) and active external entity parameter parsing enabled by the application. The AV:L assignment implies the external entity must reference a local file resource; however, if an application implements a custom external entity resolver or processes XML from untrusted network sources with entity parsing enabled, the effective attack surface becomes network-accessible - defenders should not rely solely on AV:L to infer that network delivery is impossible. C:H and I:H are well-supported: a heap overflow in a parsing library can yield arbitrary code execution. A:L rather than A:H is atypical for a heap overflow and likely reflects the assessor's judgment that reliable exploitation is more oriented toward control-flow hijack than crash. No EPSS score was provided in source data, leaving quantitative exploitation probability unknown. The vulnerability is not in CISA KEV, and no weaponized exploit exists beyond the upstream unit test. Despite the medium aggregate score, applications that accept untrusted XML and have external entity parsing enabled should treat remediation as urgent given the C:H/I:H impact potential.

An attacker submits a crafted XML document containing a DOCTYPE with 64 or more levels of deeply nested element content model declarations followed by a parameter entity reference pointing to an external resource. When a vulnerable application with XML_PARAM_ENTITY_PARSING_ALWAYS configured processes this document, libexpat creates a child parser for the external entity that inherits the parent DTD's scaffIndex by reference. As the child parser processes additional deeply nested content model declarations, m_groupSize triggers a realloc of scaffIndex using the wrong capacity, corrupting adjacent heap memory and potentially enabling code execution. No weaponized exploit exists, but the upstream PR test case provides a functional XML reproduction template.