libexpat CVE-2026-56408

The vulnerability is triggered by any XML input containing a string whose length causes charsRequired * sizeof(XML_Char) to overflow SIZE_MAX in the copyString function. No special non-default configuration is required - any application calling the libexpat parser on attacker-influenced XML input is potentially vulnerable. Exploitation is meaningfully constrained by attack complexity (AC:H): turning the heap overflow into reliable code execution requires control over heap layout, which varies by application memory usage patterns and allocator hardening (e.g., ASLR, guard pages). The NVD CVSS vector designates AV:L (local), which formally scopes the library in isolation; however, in network-facing applications such as web servers, API services, or document processors that accept XML over the network, the effective attack vector is remote and unauthenticated. Authentication requirements are not confirmed from the CVE description alone; the PR:N designation in the provided CVSS vector indicates no privileges are required at the library level.

The NVD-assigned CVSS 3.1 score of 6.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) reflects high exploitation complexity and a local attack vector - the latter being conservative for a parsing library that routinely handles XML from network-sourced input. In any network-facing application using libexpat, the effective attack surface extends to unauthenticated remote actors, materially raising real-world risk beyond what the 6.9 score communicates. AC:H is well-calibrated: reliably converting this integer-overflow-to-heap-overflow into controlled code execution demands precise heap layout manipulation. No EPSS score was provided in the available data; no CISA KEV listing exists; no public exploit code has been identified. Despite the moderate numerical score, libexpat's role as a widespread transitive dependency in Python, Apache, and many Linux distributions means patch propagation will be slow and uneven, sustaining an elevated exposure window across the ecosystem.

An attacker submits a malicious XML document containing a string element whose character count is engineered to overflow SIZE_MAX when multiplied by sizeof(XML_Char) inside copyString. The resulting malloc call allocates a buffer far smaller than needed, and the subsequent string copy overwrites adjacent heap memory. With sufficient control over heap layout - for instance, by making multiple parse requests to shape allocations - the attacker can corrupt function pointers or metadata to redirect execution and run arbitrary code in the context of the libexpat-consuming process.