Skip to main content

libexpat xmlwf CVE-2026-56409

| EUVDEUVD-2026-38186 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-jhv6-83wh-9vj5
Integer Overflow Buffer Overflow Libexpat Suse
6.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.5 MEDIUM
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
vuln.today AI
6.5 MEDIUM

Local-only tool requires active invocation with the -d flag (AV:L/UI:R); near-SIZE_MAX path lengths needed to overflow (AC:H); successful heap corruption enables code execution (C:H/I:H).

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:41 vuln.today
Analysis Generated
Jun 22, 2026 - 06:41 vuln.today
Patch available
Jun 21, 2026 - 17:01 EUVD

DescriptionCVE.org

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

AnalysisAI

Integer overflow in the xmlwf command-line utility bundled with libexpat before 2.8.2 allows heap buffer overflow when the -d outputDir flag is used with extremely long path values. The overflow occurs during malloc size calculation - (tcslen(outputDir) + tcslen(file) + 2) * sizeof(XML_Char) - wrapping the size_t to a near-zero value, causing an undersized allocation followed by out-of-bounds write during filename construction. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft near-SIZE_MAX-length outputDir or filename
Delivery
Invoke xmlwf -d <crafted_path> <xml_file>
Exploit
Integer overflow in malloc size calculation
Execution
Undersized heap buffer allocated
Persist
Filename copy overflows heap allocation
Impact
Memory corruption enables code execution
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The vulnerability is triggered only when the `xmlwf` command-line tool is invoked with the `-d outputDir` flag AND the combined byte length of the output directory path and the XML input filename approaches the platform's SIZE_MAX / sizeof(XML_Char) threshold - a condition requiring abnormally long path strings. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 6.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) accurately reflects the constrained exploitation profile: local access, high attack complexity, and mandatory user interaction all bound practical risk despite the elevated C:H/I:H impact ratings. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with influence over the `outputDir` argument or over filenames processed by an automated xmlwf pipeline supplies a directory path or filename whose combined length with the XML input filename approaches the size_t maximum. When xmlwf runs with `-d <attacker-controlled-path>`, the addition `tcslen(outputDir) + tcslen(file) + 2` wraps to a near-zero value, malloc() allocates a tiny heap buffer, and the subsequent filename string copy overflows it - potentially corrupting adjacent heap metadata and enabling code execution in the context of the process running xmlwf. …
Remediation Upgrade libexpat to version 2.8.2 or later, which introduces explicit SIZE_MAX overflow guards in xmlwf.c before both the additive and multiplicative size calculations (upstream PR #1259: https://github.com/libexpat/libexpat/pull/1259). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke
CVE-2022-40674 HIGH
8.1 Sep 14

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Rated high severity (CVSS 8.1), this
CVE-2016-5300 HIGH
7.5 Jun 16

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attacker

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8
CVE-2013-3940 CRITICAL
9.3

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-56409 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy