EUVD-2026-89028
GHSA-533f-rf84-jgcc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify 32-bit app parsing untrusted XML
-
DeliveryDeliver crafted XML payload
-
ExploitTrigger integer overflow in expat_realloc()
-
ExecutionUndersized heap allocation and buffer overflow
-
ImpactDenial of service or memory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target to be a 32-bit build of libexpat (2.7.2 through 2.8.5) - 64-bit builds are not affected because the allocation-size computation does not overflow SIZE_MAX there. The attacker must supply malicious XML to an application that parses it with the vulnerable library, and must craft input that drives expat_realloc() toward an allocation size near SIZE_MAX to trigger the overflow. Limiting factors: 32-bit-platform-only reach, high attack complexity (AC:H) and attack requirements present (AT:P) per the vendor vector, and the realistic impact appears limited to denial of service / crash rather than confirmed code execution. |
| Impact | This is a genuine but conditionally-narrow issue in an extremely widely-deployed library. The vendor CVSS 4.0 vector (8.2) is network-reachable (AV:N) and unauthenticated (PR:N), which is expected because libexpat parses attacker-supplied XML, but it also carries AC:H and AT:P - signaling that exploitation is not straightforward and depends on specific attack requirements. Critically, the flaw only manifests on 32-bit platforms, since the integer overflow occurs when computing allocation sizes against SIZE_MAX, which is 2^32-1 on 32-bit builds; 64-bit deployments are effectively unaffected. Note a signal conflict: the description claims 'heap buffer overflow, memory corruption, or denial of service,' but the vendor vector scores confidentiality and integrity as N and only availability as H (VA:H), meaning the vendor scoped the realistic outcome as denial of service rather than code execution - verify with vendor before treating this as an RCE. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input. Overall this is a real fix-worthy issue but a medium priority: ubiquitous product, but exploitation is gated by 32-bit-only reach, high complexity, and the need to drive an oversized allocation. |
| Exploit ScenarioDerived | An attacker submits crafted XML to a service running a 32-bit build of an application linked against a vulnerable libexpat (2.7.2-2.8.5). The XML is shaped to force expat_realloc() to compute an allocation size that overflows past SIZE_MAX minus padding, producing an undersized buffer and subsequent heap corruption or a crash. No public exploit code is identified at time of analysis, and success depends on the target being a 32-bit build. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Heap memory corruption in 32-bit builds of libexpat 2.7.2 through 2.8.5 lets remote attackers supply malicious XML that drives expat_realloc() past SIZE_MAX while computing an allocation size, yielding an undersized buffer and a subsequent heap overflow. The assessed impact is denial of service (crash or process instability) rather than confirmed code execution, consistent with the vendor vector (CVSS 4.0 8.2, AV:N/AC:H/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. Exploitation is conditional: only 32-bit builds are exposed (64-bit builds do not overflow SIZE_MAX in this computation), the attacker must feed crafted XML to an application that parses it with the vulnerable library, and the input must push allocation sizes toward the maximum; no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
The upstream fix is the runtime overflow guard introduced in https://github.com/libexpat/libexpat/pull/1392 and committed as https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118 - per the vendor advisory a patch is available, implemented as an explicit check in expat_realloc() that returns NULL instead of wrapping, plus a regression test using SIZE_MAX. Because the supplied references point to a PR/commit rather than a tagged release, upgrade to the first libexpat release newer than 2.8.5 that includes commit 209801d7, or backport that commit and rebuild; distribution packages should be rebuilt from the fixed source, and any vendor of a static or vendored copy (runtimes, firmware, appliances) must be tracked separately since OS package updates will not reach embedded copies. Where rebuilding is not immediately possible, the most effective compensating control is to run the parsing workload on 64-bit builds or hardware, which removes the overflow condition entirely; otherwise restrict or cap the size of untrusted XML input accepted by the parser (a trade-off that can break legitimate large documents), avoid parsing attacker-controlled XML in 32-bit processes, and reduce exposure by isolating XML parsing services so that a crash or heap corruption results in a restart rather than a broader outage - noting that input-size limits and process isolation are mitigations, not fixes. Note that because the result of the overflow condition is a heap write past the intended allocation, a crash may indicate a corrupted heap, so restarting the affected process is advisable. Details and tracking are available at https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc and the project repository https://github.com/libexpat/libexpat.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190 integer overflow in expat's internal realloc wrapper. expat_realloc() in expat/lib/xmlparse.c computes the real allocation size by adding a size_t bookkeeping header plus EXPAT_MALLOC_PADDING to the caller-requested size. On 64-bit platforms that arithmetic cannot realistically reach SIZE_MAX, but on 32-bit builds a request near SIZE_MAX wraps around, so a much smaller block is allocated than the parser believes it has, and subsequent writes overflow the heap buffer. The upstream patch shows that the code previously relied on an assert() documenting that overflow detection had already been performed by expat_heap_increase_tolerable(); because assert() is compiled out in release builds (NDEBUG), no runtime check existed. The fix (PR #1392, commit 209801d7) replaces the assert with a real runtime guard - if size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING, expat_realloc() returns NULL - and adds a regression test that passes SIZE_MAX and verifies both that the call fails and that the recorded size is unchanged. The CPE supplied (cpe:2.3:a:libexpat:libexpat) is a wildcard entry, so the definitive version boundary comes from the advisory text: 2.7.2 through 2.8.5. Because libexpat is an embedded XML parsing library, the practical attack surface is any 32-bit application, service, or appliance that parses untrusted XML with an affected build - including statically linked or vendored copies that are not updated when the host OS package is patched.
Know when Libexpat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Untrusted XML is network-reachable and unauthenticated (AV:N/PR:N), but the 32-bit-only, oversized-allocation trigger makes it AC:H; vendor scopes impact as availability-only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
Executive ViewAI
A high-severity heap corruption flaw in 32-bit builds of libexpat versions 2.7.2 through 2.8.5 can let remote, unauthenticated attackers crash or destabilize applications that parse untrusted XML, causing denial of service. Because libexpat is widely embedded, any 32-bit service handling external XML may face downtime, though no public exploit identified at time of analysis. A vendor patch is available, so leadership should ensure rapid inventory and remediation of exposed 32-bit deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high s
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
Alpine Linux: expat fixed in 2.6.2-r0
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
Exploit-DB