libexpat CVE-2026-56405

The vulnerability is triggered during attribute ID resolution within the XML parser when the internal counter i in getAttributeId reaches INT_MAX. In practice this requires processing an XML document with an extreme quantity of distinct attribute identifiers - likely in the range of billions of lookups - which may be achievable via XML namespace collision techniques that force repeated hash-table probing, or by supplying documents with degenerate attribute patterns. Exploitation is constrained by AV:L: the attacker must be able to supply crafted XML to a process that invokes libexpat's parsing routines, whether by writing a file in a location the process reads or by being the source of parsed data in a locally deployed application. Network-reachable exploitation is possible only if the consuming application processes XML supplied by remote clients, but this was not the basis of the official AV:L assessment. Exploitation is further limited by AC:H, meaning the exact triggering condition requires specific alignment of attribute count and hash-table state that is not straightforwardly reproducible across all environments.

The official CVSS 3.1 score of 6.9 with vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L reflects a carefully calibrated medium-high risk. The local attack vector (AV:L) and high complexity (AC:H) are the primary risk-dampening factors: exploitation requires not only supplying crafted XML to the target process but achieving the precise conditions to increment the counter to INT_MAX, an extremely large value that in practice demands crafted namespace collisions or bulk attribute repetition rather than a simple malformed document. Despite no privileges being required (PR:N), the AC:H rating substantially limits opportunistic exploitation. There is no CISA KEV listing and no confirmed public POC, keeping EPSS-equivalent risk low. However, the high C:H and I:H impact metrics reflect that successful exploitation can yield arbitrary memory read and write primitives. The primary real-world concern is libexpat's pervasive use as a dependency: systems running Python, PHP, or Linux components such as D-Bus or systemd that have not patched to 2.8.2 carry downstream exposure. The low availability impact (A:L) suggests the overflow is more likely to enable code execution scenarios than simple crashes. Overall this is a moderate priority: real-world exploitation is non-trivial, but the breadth of the dependency chain warrants patching on a normal patch cycle.

An attacker crafts an XML document containing a pathologically large number of attribute declarations - potentially exploiting XML namespace mechanics to force repeated attribute ID lookups - and delivers it to an application that uses libexpat for parsing (e.g., a local file processor or a network service accepting XML input). When getAttributeId processes this document, the loop counter wraps past INT_MAX, producing an invalid memory reference that can overwrite adjacent heap data and potentially redirect execution flow. No public proof-of-concept exploit has been identified at time of analysis, and the AC:H rating indicates that reliably triggering the exact overflow boundary requires careful construction.