libexpat CVE-2026-56404

Exploitation requires all of the following: (1) the target application links against libexpat prior to 2.8.2; (2) the application processes XML input that includes namespace binding declarations (xmlns: attributes), which invokes the addBinding code path; (3) the attacker can supply XML crafted to accumulate namespace bindings until len reaches INT_MAX - a high-complexity condition (AC:H) that is not trivially reproducible. AV:L indicates the attacker must provide the malicious XML via a local access path (e.g., a file on the local filesystem, IPC, or a local application interface) rather than a generic network socket. PR:N means no OS-level authentication is required to invoke the parsing path. Exploitation is limited by: the precision required to hit the exact integer boundary (AC:H); the local attack vector (AV:L) ruling out straightforward Internet-based attacks; no scope change (S:U), confining impact to the vulnerable process; and availability impact being only partial (A:L).

The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L yields a 6.9 Medium score, and the signal composition is internally consistent. AC:H is the dominant risk limiter - constructing XML namespace input that drives len precisely to INT_MAX requires non-trivial craftsmanship. AV:L further constrains the attacker pool: Internet-based remote exploitation is not implied by the official vector, though downstream applications that accept untrusted XML from network sources effectively extend the attack surface. The high C:H/I:H impact ratings indicate that if exploitation succeeds, consequences are severe, but the convergence of AC:H and AV:L makes this a lower-urgency priority than a pure CVSS score comparison would suggest. No EPSS data was provided in the available intelligence, and the vulnerability is absent from CISA KEV. No POC has been identified. Risk is primarily relevant to deployments where untrusted XML reaches libexpat through application logic, not as a standalone remote-exploitation scenario.

An attacker engineers a malicious XML document with a large volume of namespace binding declarations deliberately crafted to push the len counter in addBinding to INT_MAX, triggering signed integer overflow on the next increment and corrupting heap metadata. If this malicious document is supplied to a local application - such as a file-format converter, document processor, or configuration parser using libexpat - the resulting memory corruption could yield arbitrary code execution within the process. No public exploit code has been identified at time of analysis.