Integer Overflow Vulnerability in libexpat Affects XML Processing
CVE-2026-56410

6.9MEDIUM

Key Information:

Vendor

Libexpat Project

Status
Libexpat
Vendor
CVE Published:
21 June 2026

What is CVE-2026-56410?

An integer overflow vulnerability has been identified in libexpat versions prior to 2.8.2, specifically within the xmlwf utility. This flaw occurs during the resolution of system identifiers, which may lead to unexpected behavior or potential exploitation scenarios in applications utilizing this XML parsing library. It is crucial for users and developers leveraging libexpat for XML processing to upgrade to version 2.8.2 or later to mitigate the associated risks.

Affected Version(s)

libexpat 0 < 2.8.2

References

https://github.com/libexpat/libexpat/pull/1252

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.