libexpat EUVD-2026-38188

Exploitation requires that the xmlwf command-line utility (not the libexpat library API itself) be invoked against an attacker-controlled XML document whose DOCTYPE block contains enough NOTATION declarations to overflow a signed 32-bit integer counter - a non-default, edge-case input volume. This vulnerability does not affect network-listening services directly; it applies to environments where xmlwf is embedded in automated XML processing workflows, document validators, or developer tooling that accept untrusted file input. The high attack complexity (AC:H) reflects the need to precisely engineer the NOTATION count to cross the integer boundary. Per the CVSS vector PR:N, no privilege elevation or authentication is required to run xmlwf, but the attacker must control or influence the XML file being processed. Systems using the libexpat library API without invoking the xmlwf binary are not exposed to this specific endDoctypeDecl code path.

The CVSS 3.1 base score of 6.9 with vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L calibrates risk to a local, high-complexity attack scenario where the high C:H and I:H ratings reflect the potential for heap corruption to escalate to code execution. The local attack vector (AV:L) limits the exposure surface primarily to environments where xmlwf is used in automated XML processing pipelines, build systems, or developer tooling that accept externally supplied XML - not a direct network-facing service. The high attack complexity (AC:H) further reduces realistic exploitability because the attacker must precisely engineer the NOTATION count to hit the integer boundary. No EPSS data was included in the intelligence feed, making probabilistic exploitation comparison unavailable. The absence from CISA KEV and the lack of any identified public exploit code are both meaningful signals that exploitation remains theoretical or highly targeted at this time. The upstream fix is available as GitHub PR #1263, with the target release version stated as 2.8.2 by EUVD - though this version has not been independently confirmed via a formal release tag. On balance, this is a real vulnerability warranting prompt patching for any deployment where xmlwf processes untrusted XML, but the AC:H and local vector mean it is not an immediately weaponizable network threat.

An attacker crafts an XML file with a DOCTYPE block containing a number of NOTATION declarations sufficient to overflow a signed 32-bit integer and submits it to a CI/CD pipeline, build system, or document processing service that invokes xmlwf for XML validation. The wrapped notationCount causes an undersized heap buffer to be allocated, and the subsequent write of NotationList pointers overflows the buffer, potentially overwriting adjacent heap metadata or function pointers to redirect execution. No public proof-of-concept has been identified at time of analysis, so independent development of the overflow trigger is required.