CVE-2026-118370
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
| CWE | CWE-190 |
| Vendor | libexpat |
| Product | libexpat |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for libexpat libexpat
Be the first to know when new medium vulnerabilities affecting libexpat libexpat are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
libexpat / libexpat
0 ≤ 2.9.0
References
github.com: https://github.com/libexpat/libexpat/pull/1450 github.com: https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae github.com: https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c github.com: https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140 github.com: https://github.com/libexpat/libexpat vulncheck.com: https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes
Credits
Mirko Swillus Sebastian Pipping