CVE-2026-118370
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
libexpat libexpatLibraries & packages
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
Text from CVE List
Affected versions 1
- libexpataffected: all versions through 2.9.0CVE List
References 6
- github.com/libexpat/libexpat/pull/1450Fixvia CVE List
- github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750aeFixvia CVE List
- github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04cFixvia CVE List
- vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixesAdvisoryvia CVE List
- github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140Referencevia CVE List
- github.com/libexpat/libexpatReferencevia CVE List