CVE-2026-56405

libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow

Published Jun 21, 2026 CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

libexpat before 2.8.2 has an integer overflow in getAttributeId.

Analysis

Technical impact

libexpat before version 2.8.2 contains an integer overflow in the getAttributeId function, which can corrupt memory for malformed XML input. The overflow may result in a crash or denial of service, and while the CVE description does not indicate remote code execution, the corruption could be leveraged by a local attacker to destabilize services.

Affected Systems

The vulnerability affects the libexpat project’s libexpat library for all releases prior to 2.8.2. Any system using a pre‑2.8.2 build of this library is at risk.

Risk and Exploitability

With a CVSS score of 6.9, the risk is moderate. The EPSS score is not provided and the issue is not listed in the CISA KEV catalog, indicating no known active exploitation at the time of assessment. Attackers would need to supply crafted XML data to trigger the overflow, typically through local or elevated code that parses XML files. The impact is primarily denial of service unless coupled with additional vulnerabilities.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

libexpat project

libexpat

unaffected

Version	Status	Constraints
`0`	affected	< 2.8.2

Configuration 1 [-]

cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Libexpat Project

Libexpat

Version	Status	Scheme	Platform
`[0,2.8.2)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update libexpat to version 2.8.2 or later, which resolves the integer overflow
Restart any services that use libexpat after upgrading to ensure the new library is loaded
As a temporary measure, validate or limit XML input length or structure to reduce the likelihood of triggering the overflow until the update can be applied

Generated by OpenCVE AI on June 21, 2026 at 17:23 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4765-1	expat security update
Debian DSA	DSA-6404-1	expat security update
Ubuntu USN	USN-8790-1	Expat vulnerabilities
Ubuntu USN	USN-8872-1	libxmltok vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.141% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://github.com/libexpat/libexpat/pull/1251
https://nvd.nist.gov/vuln/detail/CVE-2026-56405
https://www.cve.org/CVERecord?id=CVE-2026-56405

History

Nov 10, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-457936.html

Jun 23, 2026 12:15 PM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Integer Overflow in libexpat getAttributeId before 2.8.2	libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow
References		https://nvd.nist.gov/vuln/detail/CVE-2026-56405 https://www.cve.org/CVERecord?id=CVE-2026-56405
Metrics	threat_severity `None`	threat_severity `Moderate`

Jun 22, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 21, 2026 5:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Integer Overflow in libexpat getAttributeId before 2.8.2

Jun 21, 2026 4:00 PM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		libexpat before 2.8.2 has an integer overflow in getAttributeId.
First Time appeared		Libexpat Project Libexpat Project libexpat
Weaknesses		CWE-190
CPEs		cpe:2.3:a:libexpat_project:libexpat::::::::
Vendors & Products		Libexpat Project Libexpat Project libexpat
References		https://github.com/libexpat/libexpat/pull/1251
Metrics		cvssV3_1 `{'score': 6.9, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L'}`