libexpat CVE-2026-56406

The vulnerable code path is only reachable when an application explicitly calls XML_ParseBuffer rather than XML_Parse - a developer choice that is common in streaming and zero-copy parsing patterns but not universal. The integer overflow is triggered when the cumulative sum of the len arguments passed across successive XML_ParseBuffer calls exceeds XML_INDEX_MAX for the parser's signed index type. In practice this requires the attacker to supply an extremely large total volume of XML data - or a carefully crafted sequence of buffer lengths - to a session using XML_ParseBuffer. Applications that cap input size before calling the library are less exposed. The CVSS AC:H rating reflects this non-trivial triggering condition. No authentication is assigned by the provided CVSS vector (PR:N), but the AV:L assignment means the NVD considers local access to be the baseline requirement; in network-facing applications that pass attacker-controlled XML to XML_ParseBuffer, this local constraint does not apply.

The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) scores 6.9 and assigns a local attack vector with high complexity. The local designation is notable and warrants scrutiny: libexpat is a library, not a service, so the NVD assessors may have determined that triggering the overflow requires local delivery of a crafted buffer - e.g., via a file or IPC channel - rather than a direct network socket. However, libexpat is pervasively embedded in network-facing daemons, and in those contexts an attacker supplying a crafted XML stream over the network would effectively achieve AV:N. This is a meaningful discrepancy - defenders using CVSS AV:L in isolation may under-prioritize patching in network-facing deployments. AC:H reflects the precision required to engineer an integer wraparound to a useful heap primitive rather than merely a crash. No EPSS data was provided in the input; no CISA KEV listing exists, and no POC has been identified, suggesting exploitation risk is currently theoretical. The high C and I impact scores are credible given the potential for heap corruption enabling code execution. Overall this is a real patching priority for any system using libexpat before 2.8.2, particularly in network-exposed contexts, despite the moderate overall CVSS score.

An attacker controls XML content processed by an application using XML_ParseBuffer in incremental mode - for example, a document editor, a messaging daemon, or a network service consuming XML-encoded data. By crafting a sequence of buffer chunks whose cumulative byte lengths cause m_parseEndByteIndex to overflow XML_INDEX_MAX, the attacker corrupts internal parser state. Depending on heap layout, this could enable arbitrary write primitives leading to code execution in the context of the parsing application. No public exploit code has been identified at time of analysis, and successful exploitation requires careful heap-grooming, placing this in the proof-of-concept development stage rather than widespread automated exploitation.