Integer Overflow Vulnerability in Expat Library Affecting Multiple Products
CVE-2026-56408

6.9MEDIUM

Key Information:

Vendor

Libexpat Project

Status
Libexpat
Vendor
CVE Published:
21 June 2026

What is CVE-2026-56408?

The Expat library, specifically versions prior to 2.8.2, contains an integer overflow vulnerability within the copyString function. This can lead to potential exploitation where attackers might manipulate input sizes, resulting in unexpected behavior or program crashes. Users of affected versions are urged to update to the latest release to mitigate associated risks.

Affected Version(s)

libexpat 0 < 2.8.2

References

https://github.com/libexpat/libexpat/commit/16e2efd867ea8...

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.