Skip to main content

libexpat CVE-2026-56406

| EUVDEUVD-2026-38183 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-v2j6-3q6q-gm3g
Buffer Overflow Integer Overflow Red Hat Libexpat Suse Libexpat Project
6.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
7.7 HIGH

AV:N reflects libexpat's pervasive use in network services; AC:H retained for integer overflow precision; no auth or interaction required.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:40 vuln.today
Analysis Generated
Jun 22, 2026 - 06:40 vuln.today
Patch available
Jun 21, 2026 - 17:01 EUVD

DescriptionCVE.org

libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.

AnalysisAI

Integer overflow in libexpat's XML_ParseBuffer function allows potential heap corruption leading to high-confidentiality and high-integrity impact in all libexpat versions before 2.8.2. The overflow occurs because XML_ParseBuffer lacked a bounds check on the byte index accumulator that was already present in the sibling XML_Parse function - a defensive guard omitted asymmetrically between two code paths. Any application that routes XML input through XML_ParseBuffer (a common pattern in incremental parsing) is exposed. No public exploit has been identified at time of analysis and no KEV listing exists, but the high C and I CVSS impact ratings reflect the potential for code execution via heap corruption.

Technical ContextAI

libexpat (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*) is a widely-embedded C XML parsing library used by Python's xml.etree, Apache httpd, PHP, DBus, and many others. It exposes two primary parsing entry points: XML_Parse for single-call use and XML_ParseBuffer for incremental or zero-copy buffer parsing. The root cause is CWE-190 (Integer Overflow or Wraparound): the accumulator field m_parseEndByteIndex is a signed integer that tracks how many bytes have been processed. When XML_ParseBuffer adds the caller-supplied len to this field without checking for overflow (as confirmed by the GitHub PR #1255 diff), the result can wrap around to a negative or small positive value. This corrupts internal state used for offset calculations and could facilitate writes to arbitrary heap locations. The fix adds a pre-check: if len > XML_INDEX_MAX - parser->m_parseEndByteIndex, parsing is aborted with XML_ERROR_NO_MEMORY, mirroring a check already present in XML_Parse.

RemediationAI

Upgrade libexpat to version 2.8.2 or later, which introduces the overflow guard in XML_ParseBuffer mirroring the check already in XML_Parse. The upstream fix is available at https://github.com/libexpat/libexpat/pull/1255. Downstream consumers of libexpat must rebuild or redeploy against the patched library version. If immediate patching is not possible, consider restricting the maximum size of XML inputs accepted by affected applications at an application or network perimeter layer - for example, enforcing a Content-Length or read-buffer cap below the threshold at which m_parseEndByteIndex can overflow XML_INDEX_MAX. This is a mitigating control only and does not eliminate the vulnerability; it reduces the attack surface by preventing the specific integer arithmetic from being reached. Vendors bundling libexpat should consult https://nvd.nist.gov/vuln/detail/CVE-2026-56406 and the VulDB advisory at https://vuldb.com/vuln/372641 for additional context. No patch version beyond 2.8.2 has been independently confirmed at time of analysis - verify against the upstream release page.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-56406 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy