Skip to main content

libexpat EUVDEUVD-2026-38180

| CVE-2026-56403 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-xqw9-f65g-5qxw
Integer Overflow Buffer Overflow Libexpat Red Hat Suse
6.9
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
7.7 HIGH

AV:N reflects libexpat's primary deployment parsing network-sourced XML; AC:H because the overflow requires namespace tokens approaching INT_MAX length, an inherently difficult constraint.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:38 vuln.today
Analysis Generated
Jun 22, 2026 - 06:38 vuln.today
Patch available
Jun 21, 2026 - 17:01 EUVD

DescriptionNVD

libexpat before 2.8.2 has an integer overflow in storeAtts.

AnalysisAI

Integer overflow in libexpat's storeAtts() function before version 2.8.2 allows heap buffer corruption during XML namespace attribute processing. When an XML document contains namespace-qualified attributes whose prefix name or local-part name approaches or exceeds INT_MAX bytes, the combined expanded-name length calculation wraps to a small integer, causing allocation of an undersized heap buffer followed by an out-of-bounds write during the memcpy phase. The vendor CVSS scores this 6.9 with High confidentiality and integrity impact; no public exploit has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog.

Technical ContextAI

libexpat (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*) is a widely embedded C streaming XML parser used in Python's pyexpat module, Apache httpd, D-Bus, and hundreds of downstream packages across Linux distributions. The vulnerable code path is in storeAtts() within expat/lib/xmlparse.c, which constructs expanded XML attribute names by concatenating three components: namespace URI length (binding->uriLen), namespace prefix length (prefixLen), and local-part length (i). Pre-fix, both prefixLen and i were declared as int, and the null-terminator counting loops incremented them without overflow checks. CWE-190 (Integer Overflow or Wraparound) is the precise root cause: if candidateLen (the prefix character count) or localPartLen (the local-part character count) surpasses INT_MAX during accumulation, the value wraps to a small positive number, making totalLen far smaller than the actual string. The downstream memcpy then writes the full-length string into the under-allocated buffer, corrupting adjacent heap metadata. The fix in PR #1232 switches intermediate variables to size_t and inserts explicit INT_MAX and SIZE_MAX guards before the cast and memcpy call.

RemediationAI

The primary fix is to upgrade libexpat to version 2.8.2 or later, which adds size_t-typed intermediate variables and explicit INT_MAX/SIZE_MAX overflow guards in storeAtts() (see https://github.com/libexpat/libexpat/pull/1232). Downstream packages - Linux distribution libexpat packages, Python interpreters, PHP builds, and any software statically linking libexpat - must be rebuilt or updated against 2.8.2; distribution vendors should be monitored for security update advisories. If an immediate upgrade is not possible, a compensating control is to enforce strict XML document and individual token size limits at the application layer before passing input to libexpat, rejecting any document whose namespace prefix or local-part identifier exceeds a safe ceiling (e.g., a few thousand characters); this requires application-level changes and may reject pathological but technically valid XML edge cases. WAF rules that cap HTTP request body size or reject anomalously large XML payloads can reduce network-sourced attack surface but do not protect file-based or local-IPC processing paths. No additional vendor advisory URL beyond the GitHub PR and NVD entry is present in the available intelligence.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

EUVD-2026-38180 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy