Skip to main content

libexpat CVE-2026-56405

| EUVDEUVD-2026-38182 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-hqmj-33cm-gqpq
Buffer Overflow Integer Overflow Red Hat Libexpat Suse Libexpat Project
6.9
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
6.9 MEDIUM

AV:L and AC:H reflect that triggering INT_MAX overflow requires crafted local XML input under specific attribute-count conditions; C:H/I:H from memory corruption potential.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:40 vuln.today
Analysis Generated
Jun 22, 2026 - 06:40 vuln.today
Patch available
Jun 21, 2026 - 17:01 EUVD

DescriptionNVD

libexpat before 2.8.2 has an integer overflow in getAttributeId.

AnalysisAI

Integer overflow in libexpat's getAttributeId routine exposes any application embedding libexpat before version 2.8.2 to memory corruption with high confidentiality and integrity impact when parsing specially crafted XML documents. The flaw occurs when an internal counter traversing the attribute ID table reaches INT_MAX and wraps, producing an invalid index that can corrupt adjacent heap memory. No public exploit has been identified at time of analysis, and CISA has not listed this in the KEV catalog, but a vendor-released patch is available in libexpat 2.8.2 and upgrade is the recommended remediation.

Technical ContextAI

libexpat (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*) is a widely embedded C XML parsing library used across Linux system components, Python's xml.parsers.expat, PHP, and many other projects. The vulnerable function getAttributeId in expat/lib/xmlparse.c manages a hash-based lookup table of XML attribute identifiers. CWE-190 (Integer Overflow or Wraparound) describes the root cause: the loop counter variable i, a signed integer, increments without bounds checking and can wrap from INT_MAX (2,147,483,647) to a negative value, which when used as an array or table index results in an out-of-bounds memory access. The GitHub PR #1251 fix inserts a single guard: if i reaches INT_MAX, the function returns NULL rather than overflowing. The tags 'Buffer Overflow' and 'Integer Overflow' indicate that the integer wraparound leads downstream to an out-of-bounds write, consistent with typical CWE-190 exploitation paths.

RemediationAI

Upgrade to libexpat 2.8.2, which introduces the INT_MAX guard in getAttributeId as documented in the upstream fix at https://github.com/libexpat/libexpat/pull/1251. Distribution packages (e.g., expat on Debian/Ubuntu/RHEL) should be updated via the system package manager as soon as the distribution maintainer ships the patched version. Applications that statically link libexpat must be recompiled against the 2.8.2 source. If immediate patching is not possible, a compensating control is to restrict or sanitize XML input at the application boundary to reject documents with an abnormally large number of attributes or deeply nested namespace declarations; however, this approach is fragile and not a substitute for patching since the exact triggering threshold depends on runtime conditions. No workaround fully eliminates the risk without the upstream fix.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-56405 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy