libexpat CVE-2026-56407

The vulnerability is reachable whenever libexpat before 2.8.2 processes an XML document containing entity declarations in the prolog - this is standard XML and requires no non-default parser configuration. The precondition is that the attacker can supply XML input whose entity values collectively accumulate to a pool length exceeding INT_MAX bytes; crafting such input requires generating extremely large entity value content, which imposes a practical size constraint on the attack payload. The CVSS AV:L vector limits the official rating to local attack scenarios, but this should be verified per deployment: any application that accepts XML from a network source, file upload, or inter-process message passes attacker data directly into the vulnerable path. Exploitation to achieve C:H/I:H (controlled heap corruption) is limited by AC:H - precise heap layout control is required, and the immediate observed behavior without a refined exploit is a graceful XML_ERROR_NO_MEMORY return rather than a crash. No authentication is required to reach the parser (PR:N) and no user interaction is needed beyond the service processing the XML.

The provided CVSS vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L (score 6.9) characterizes this as a local, high-complexity attack with no authentication requirement. The AV:L classification is notable and potentially conservative: libexpat is routinely used in applications that parse XML originating from network or untrusted external sources, which would place the effective attacker-reachable attack surface at the network layer for many deployments. Security teams should treat the AV:L rating as an CVSS baseline requiring per-deployment verification rather than a universal constraint. The AC:H rating is well-supported - converting an integer overflow in a heap allocator pool to controlled memory read/write (C:H/I:H) requires precise heap layout manipulation and is nontrivial. No EPSS data was present in the provided intelligence. The absence from CISA KEV and absence of identified public exploit code further supports treating this as an important-but-not-immediately-critical issue for most environments. The A:L rating (low availability impact) is notable: the most likely immediate outcome of triggering the overflow without a refined exploit is a parser error return (XML_ERROR_NO_MEMORY) rather than a crash, which the fix confirms. Exploitation for full C:H/I:H impact remains a more complex proposition.

An attacker submits a crafted XML document to any service or application that uses libexpat < 2.8.2 to parse externally supplied XML - such as a REST API accepting XML payloads, a file upload endpoint, or a network protocol parser. The document contains entity declarations with aggregate value content exceeding INT_MAX bytes, driving the doProlog entity value pool length past the signed integer boundary and corrupting adjacent heap metadata. No public exploit code has been identified at time of analysis, and achieving the full C:H/I:H impact from this heap corruption would require significant exploit development effort consistent with the CVSS AC:H rating.