Skip to main content

libexpat CVE-2026-56407

| EUVDEUVD-2026-38184 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-r8qx-5vfx-8w6r
Buffer Overflow Integer Overflow Red Hat Libexpat Suse Libexpat Project
6.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
7.7 HIGH

libexpat commonly parses externally sourced XML justifying AV:N; heap corruption from integer overflow requires precise memory control, warranting AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:42 vuln.today
Analysis Generated
Jun 22, 2026 - 06:42 vuln.today
Patch available
Jun 21, 2026 - 17:01 EUVD

DescriptionCVE.org

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

AnalysisAI

Integer overflow in libexpat before 2.8.2 allows heap corruption during XML prolog parsing when accumulated entity value pool length exceeds INT_MAX, yielding high confidentiality and integrity impact per CVSS. The flaw resides in doProlog and the related storeSelfEntityValue path, where poolLength() return values are cast to signed integers without bounds validation - a gap closed in the upstream fix via explicit INT_MAX guards. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, but the widespread use of libexpat as a dependency across system tools, language runtimes, and XML-processing services means the blast radius of a weaponized exploit would be broad.

Technical ContextAI

libexpat (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*) is a stream-oriented, event-driven C library for XML parsing used as a dependency by Python's pyexpat module, numerous system utilities, and many network-facing services. The root cause is CWE-190 (Integer Overflow or Wraparound): during XML document prolog processing, the doProlog function accumulates entity declaration values into a memory pool managed by poolLength(). That length value is then operated on as a signed int. If an attacker constructs XML entity declarations whose combined value data causes poolLength() to return a value exceeding INT_MAX (2,147,483,647), the subsequent signed cast wraps to a negative value, producing incorrect size arithmetic and enabling heap corruption. The GitHub PR #1262 diff confirms the fix inserts explicit guard checks - comparing (size_t)poolLength(pool) against (size_t)INT_MAX - in both doProlog and storeSelfEntityValue before returning XML_ERROR_NO_MEMORY. The tags 'Buffer Overflow' and 'Integer Overflow' both apply: the integer overflow is the root cause, and heap buffer corruption is the consequential impact.

RemediationAI

The primary remediation is upgrading libexpat to version 2.8.2 or later, where the integer overflow guards introduced in GitHub PR #1262 (https://github.com/libexpat/libexpat/pull/1262) eliminate the vulnerable code paths in both doProlog and storeSelfEntityValue. Applications that dynamically link against a system-provided libexpat should apply OS vendor security updates once packaged for their distribution. Applications that statically link libexpat must recompile against the patched source - a system-level package update alone will not remediate statically linked binaries, which is a common oversight in large dependency graphs. If immediate patching is blocked, a targeted compensating control is to enforce maximum XML document size and entity count limits at the application layer before passing input to expat, preventing the pool from accumulating enough data to approach INT_MAX; however, this control is application-specific and not universally configurable. Disabling external entity processing (XML_SetExternalEntityRefHandler, FEATURE_BILLIONLAUGHS protections) reduces attack surface but does not protect against this flaw, as the overflow is in the internal entity value storage path. Patch availability is confirmed upstream per PR #1262; downstream distribution packages should be monitored for release timing.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-56407 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy