Heap-Based Buffer Overflow in libexpat Affects Multiple Software Products
CVE-2026-56132

6.9MEDIUM

Key Information:

Vendor

Libexpat Project

Status
Libexpat
Vendor
CVE Published:
19 June 2026

What is CVE-2026-56132?

A vulnerability exists in libexpat prior to version 2.8.2, where a heap-based buffer overflow can occur in doProlog within xmlparse.c. This security flaw is triggered due to incorrect handling of scaffold backing array reallocation, particularly affecting data-structure sharing across different parsers. Consequently, this may lead to potential data corruption and security risks for applications utilizing libexpat.

Affected Version(s)

libexpat 0 < 2.8.2

References

https://github.com/libexpat/libexpat/pull/1272

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.