Skip to main content

libexpat CVE-2026-56404

| EUVDEUVD-2026-38181 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-h5j3-rr49-jmm6
Buffer Overflow Integer Overflow Red Hat Libexpat Suse Libexpat Project
6.9
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
6.9 MEDIUM

Signed integer overflow requires precision-crafted XML to reach INT_MAX (AC:H); no OS privileges needed for the parse path (PR:N); AV:L per vendor and NVD assessment; A:L reflects partial rather than full availability disruption.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:40 vuln.today
Analysis Generated
Jun 22, 2026 - 06:40 vuln.today
Patch available
Jun 21, 2026 - 17:01 EUVD

DescriptionNVD

libexpat before 2.8.2 has an integer overflow in addBinding.

AnalysisAI

Integer overflow in libexpat's addBinding function (xmlparse.c) before version 2.8.2 allows memory corruption during XML namespace binding processing, with high confidentiality and integrity impact. All libexpat releases from 0 through 2.8.2-pre are affected (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*), encompassing a significant downstream attack surface given the library's widespread use in Python, PHP, and system utilities. No public exploit or active exploitation has been confirmed at time of analysis; the official CVSS 3.1 score of 6.9 reflects meaningful impact tempered by high attack complexity and a local attack vector.

Technical ContextAI

libexpat is a widely deployed C library for streaming XML parsing, foundational to CPython, PHP, and numerous Linux distribution packages. The vulnerable function addBinding in expat/lib/xmlparse.c processes XML namespace declarations and maintains a signed integer counter len to track accumulated binding data. CWE-190 (Integer Overflow or Wraparound) applies: without bounds checks, len can reach INT_MAX, and a subsequent increment wraps the signed integer, producing undefined behavior and potential heap corruption. The GitHub PR #1249 patch adds two explicit if (len == INT_MAX) { return XML_ERROR_NO_MEMORY; } guards at critical accumulation points within addBinding, short-circuiting the overflow safely before memory operations proceed.

RemediationAI

The primary fix is upgrading to libexpat 2.8.2 or later, which incorporates the integer overflow guards in addBinding. The upstream fix is available as GitHub PR #1249 (https://github.com/libexpat/libexpat/pull/1249); note this is a pull-request reference rather than a formal tagged-release advisory, so organizations should confirm that distribution packages labeled 2.8.2 incorporate this commit before relying on them. Applications that statically link libexpat must be recompiled against the patched source. If immediate patching is not feasible, compensating controls include restricting input XML to trusted, validated sources at the application layer; sandboxing the XML-parsing process using seccomp, AppArmor, or similar OS-level confinement to bound the blast radius of any memory corruption; and disabling XML namespace processing features if the application does not require them (trade-off: may break standards-compliant XML handling). Distribution-specific backport patches (Debian, Red Hat, Alpine) should be checked independently.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-56404 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy