Skip to main content

libexpat CVE-2026-56132

| EUVDEUVD-2026-37977 MEDIUM
Incorrect Synchronization (CWE-821)
2026-06-19 mitre GHSA-425r-vwq2-26qv
Buffer Overflow Libexpat Red Hat Suse
6.9
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
6.9 MEDIUM

Local vector retained because standard external entity resolution targets local files; AC:H reflects required non-default configuration plus precise nesting depth; PR:N since no attacker system privilege is needed.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Patch available
Jun 19, 2026 - 07:16 EUVD
Source Code Evidence Fetched
Jun 19, 2026 - 04:47 vuln.today
Analysis Generated
Jun 19, 2026 - 04:47 vuln.today

DescriptionNVD

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.

AnalysisAI

Heap-based buffer overflow in libexpat before 2.8.2 allows heap memory corruption in applications that process externally-supplied XML with external entity parameter parsing enabled. The flaw resides in the doProlog function of xmlparse.c, where the scaffold backing array (scaffIndex) - used to index DTD content model tree nodes - is reallocated using the child parser's m_groupSize counter, which diverges from the actual allocated capacity of the shared scaffIndex inherited from the parent parser. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, but the upstream fix PR includes a functional reproduction test case confirming exploitability.

Technical ContextAI

libexpat (cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*) is a widely embedded C XML stream parser used as a dependency in Python, Perl, PHP, D-Bus, Subversion, and most Linux distributions. The root cause is CWE-821 (Incorrect Synchronization): when an application creates an external entity sub-parser via XML_ExternalEntityParserCreate, the child parser inherits the parent's DTD structure by reference, including the scaffIndex array. Prior to the fix, reallocation of scaffIndex was gated on parser->m_groupSize - a counter tracking the current parser's connector array size - rather than the actual allocated capacity of the shared DTD's scaffIndex. Because the child parser's m_groupSize can grow independently of the capacity at which the parent originally allocated scaffIndex, the realloc call operates with an incorrect size, producing a heap overflow. The fix introduces a dedicated scaffIndexSize field to the DTD structure (initialized in dtdCreate, reset in dtdReset, and copied in dtdCopy) so that scaffIndex reallocation is gated on its own tracked capacity. The prior code also erroneously interleaved scaffIndex reallocation inside the m_groupConnector reallocation block, which the fix restructures into a separate, correctly bounded allocation check.

RemediationAI

Upgrade libexpat to version 2.8.2 or later as stated in the CVE description. The upstream code change is available in GitHub PR #1272 (https://github.com/libexpat/libexpat/pull/1272); organizations should confirm the PR has been merged and tagged in a formal 2.8.2 release before relying on distribution packages claiming this fix, as the only provided reference is the PR rather than a release tag. As a targeted workaround for applications that cannot immediately upgrade, disable external entity parameter parsing by calling XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_NEVER) - this eliminates the shared child-parser DTD scenario required to trigger the overflow, though it will break any functionality that depends on DTD external parameter entities, which is a narrow but real compatibility trade-off. Applications that process only fully trusted, internally generated XML can de-prioritize patching, but any path that accepts externally sourced XML with external entity parsing active should be patched before other less-exposed consumers. Linux distributions (Debian, Ubuntu, Red Hat, Alpine) will ship updated expat packages; verify with each distribution's security advisory channel.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke

Same weakness CWE-821 – Incorrect Synchronization

View all
CVE-2024-1739 CRITICAL POC
9.1
CVE-2022-1931 HIGH POC
8.1
CVE-2024-1902 HIGH POC
7.5
CVE-2024-5755 MEDIUM POC
5.3
CVE-2026-21919 HIGH
7.1
CVE-2026-77584 HIGH
7.0
CVE-2023-5088 HIGH
7.0
CVE-2024-6657 MEDIUM
6.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

CVE-2026-56132 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy