Skip to main content

libexpat xmlwf CVE-2026-56409

| EUVDEUVD-2026-38186 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-jhv6-83wh-9vj5
Integer Overflow Buffer Overflow Libexpat Suse
6.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.5 MEDIUM
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
vuln.today AI
6.5 MEDIUM

Local-only tool requires active invocation with the -d flag (AV:L/UI:R); near-SIZE_MAX path lengths needed to overflow (AC:H); successful heap corruption enables code execution (C:H/I:H).

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:41 vuln.today
Analysis Generated
Jun 22, 2026 - 06:41 vuln.today
Patch available
Jun 21, 2026 - 17:01 EUVD

DescriptionCVE.org

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

AnalysisAI

Integer overflow in the xmlwf command-line utility bundled with libexpat before 2.8.2 allows heap buffer overflow when the -d outputDir flag is used with extremely long path values. The overflow occurs during malloc size calculation - (tcslen(outputDir) + tcslen(file) + 2) * sizeof(XML_Char) - wrapping the size_t to a near-zero value, causing an undersized allocation followed by out-of-bounds write during filename construction. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the heap overflow primitive is well-understood and could yield code execution in automated XML processing pipelines.

Technical ContextAI

libexpat (cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*) is a widely-deployed C XML parsing library; xmlwf is its bundled command-line well-formedness checker. The vulnerable code in expat/xmlwf/xmlwf.c computes a malloc() size via two consecutive unsafe arithmetic operations: an additive step tcslen(outputDir) + tcslen(file) + 2 and a multiplicative step * sizeof(XML_Char). Either operation can silently wrap around a size_t (CWE-190: Integer Overflow or Wraparound), producing a value far smaller than the combined path lengths require. The subsequent string copy into the undersized buffer writes past the heap allocation boundary - a classic integer-overflow-to-heap-overflow chain, reflected in the 'Buffer Overflow' tag alongside 'Integer Overflow'. The upstream fix in PR #1259 mirrors guards already used elsewhere in the codebase (xcsdup() and resolveSystemId()), adding explicit SIZE_MAX boundary checks before both arithmetic steps.

RemediationAI

Upgrade libexpat to version 2.8.2 or later, which introduces explicit SIZE_MAX overflow guards in xmlwf.c before both the additive and multiplicative size calculations (upstream PR #1259: https://github.com/libexpat/libexpat/pull/1259). If an immediate upgrade is not feasible, discontinue or restrict use of the xmlwf -d outputDir invocation mode, particularly in any automated pipeline that processes untrusted XML files or accepts externally-supplied directory paths. As a compensating control, enforce OS-level or application-level limits on filesystem path lengths before passing them to xmlwf (e.g., reject paths exceeding PATH_MAX); this prevents the near-SIZE_MAX lengths required to trigger the overflow. Note that restricting path length may affect legitimate deep-directory processing. The core libexpat parsing API does not require remediation for this specific CVE.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-56409 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy