Integer Overflow Vulnerability in libexpat Affects Users of Expat XML Parser
CVE-2026-56405

6.9MEDIUM

Key Information:

Vendor

Libexpat Project

Status
Libexpat
Vendor
CVE Published:
21 June 2026

What is CVE-2026-56405?

An integer overflow has been identified in libexpat prior to version 2.8.2, specifically in the getAttributeId function. This vulnerability may allow an attacker to exploit the overflow and potentially cause unexpected behavior or crashes in applications relying on this XML parser. It is important for users and developers to update to the latest version to ensure protection against potential exploitation.

Affected Version(s)

libexpat 0 < 2.8.2

References

https://github.com/libexpat/libexpat/pull/1251

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.