Skip to main content

libexpat EUVDEUVD-2026-38188

| CVE-2026-56411 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-06-21 mitre GHSA-68vw-xv3c-52vp
Integer Overflow Buffer Overflow Libexpat Red Hat Suse
6.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vuln.today AI
6.9 MEDIUM

Local vector because xmlwf processes on-disk files; AC:H for required precision in crafting NOTATION count; C:H/I:H reflect heap corruption potential enabling code execution.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 22, 2026 - 06:43 vuln.today
Analysis Generated
Jun 22, 2026 - 06:43 vuln.today
Patch available
Jun 21, 2026 - 18:01 EUVD

DescriptionCVE.org

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

AnalysisAI

Integer overflow in the xmlwf utility bundled with libexpat before 2.8.2 enables heap corruption via XML documents containing an excessive number of NOTATION declarations in a DOCTYPE block. The flaw in endDoctypeDecl allows a crafted XML file to wrap a signed integer counter, producing an undersized heap allocation that can be overflowed with high confidentiality and integrity impact. No confirmed active exploitation (not in CISA KEV) and no public exploit code have been identified at time of analysis; vendor-released patch is available in libexpat 2.8.2.

Technical ContextAI

The vulnerable component is the xmlwf command-line XML well-formedness checker bundled with the libexpat C library (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*), a widely deployed XML parsing library used across countless open-source and commercial projects. The root cause is CWE-190 (Integer Overflow or Wraparound): the endDoctypeDecl callback in expat/xmlwf/xmlwf.c used a signed int to accumulate the count of NOTATION declarations encountered in a DOCTYPE block. When a crafted XML document contains enough NOTATION entries to exceed INT_MAX, the counter wraps to a negative value, corrupting the size argument passed to the subsequent memory allocation (notationCount * sizeof(NotationList *)), yielding a heap buffer smaller than required and enabling an out-of-bounds write. The PR #1263 diff confirms the fix: notationCount and the loop variable i are retyped from int to size_t, and an explicit pre-multiplication overflow guard (if notationCount > SIZE_MAX / sizeof(NotationList *)) is inserted before the allocation, mirroring existing guards in xcsdup() and resolveSystemId() elsewhere in the codebase.

RemediationAI

Upgrade libexpat to version 2.8.2 or later, which reintroduces the notationCount and loop variable as size_t and adds an explicit pre-multiplication overflow guard before the NotationList allocation; the upstream patch is at https://github.com/libexpat/libexpat/pull/1263. The fix version 2.8.2 should be verified against the official libexpat GitHub releases page, as the PR is the only upstream source reference in the available intelligence. If an immediate upgrade is not feasible, restrict xmlwf usage in automated pipelines to trusted, internally generated XML only and prevent processing of externally supplied or user-controlled XML documents - this eliminates the attacker-controlled input prerequisite. An upstream XML sanitizer that strips or caps NOTATION declarations in DOCTYPE blocks can serve as a compensating control, though it introduces parsing complexity and an additional attack surface. Deployments that use only the libexpat library API directly (not the xmlwf binary) are not affected by this specific endDoctypeDecl code path, but a full library upgrade is still recommended as best practice.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

EUVD-2026-38188 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy