CVE-2026-102633
libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
libexpat libexpatLibraries & packages
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
Text from CVE List
Affected versions 1
- libexpataffected: 2.7.2 through 2.8.5CVE List
References 5
- github.com/libexpat/libexpat/pull/1392Fixvia CVE List
- github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118Fixvia CVE List
- vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-reallocAdvisoryvia CVE List
- github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003Referencevia CVE List
- github.com/libexpat/libexpatReferencevia CVE List