Integer Overflow Vulnerability in libexpat Affects Multiple Applications
CVE-2026-56407

6.9MEDIUM

Key Information:

Vendor

Libexpat Project

Status
Libexpat
Vendor
CVE Published:
21 June 2026

What is CVE-2026-56407?

An integer overflow has been identified in libexpat prior to version 2.8.2, specifically in the doProlog function which relates to storeEntityValue and the text length of entities. This vulnerability may lead to potential exploitation scenarios where an attacker could manipulate entity values, causing unexpected behaviors in applications that rely on the library.

Affected Version(s)

libexpat 0 < 2.8.2

References

https://github.com/libexpat/libexpat/pull/1262

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.