libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
Priority LOW 32CWE-190Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Partial Red Hat: 1 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00174 6th percentileScored 2026-11-07
Fix Partial libexpat (libexpat project): 2.8.2Red Hat: 1 advisoryRed Hat: 1 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| libexpat project | libexpat | before 2.8.2 | 2.8.2 | Patch available | CNA |
- libexpat Vendorlibexpat project Affected before 2.8.2 Fixed in 2.8.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* | before 2.8.2 | Vulnerable | libexpat project |
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions before 2.8.2 Vulnerable ·libexpat project
Remediation
- Fix · CNA libexpat (libexpat project) Fixed in 2.8.2
Red Hat 1 advisory
- RHSA-2026:40486 Released 2026-07-15 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images expat-2.8.2-1.1.hum1@aarch64, expat-2.8.2-1.1.hum1@src, expat-2.8.2-1.1.hum1@x86_64 +4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
libexpat 2.8.2
10 records Highest priority Priority LOW 10 LOW
Other records, highest priority first
- TI-2026-40764 Integer overflow in libexpatPriority LOW 32
- TI-2026-40761 libexpat before 2.8.2 has an integer overflow in storeAtts.Priority LOW 32
- TI-2026-40769 xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.Priority LOW 31
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:40486 |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-56407
- 2026-10-03 Alias added: GHSA-r8qx-5vfx-8w6r
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
More libexpat project Libexpat vulnerabilities
- TI-2022-09008 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVSS 3.1CRITICAL 9.8
- TI-2026-79488 Billion laughs detection delay in libexpat enables denial of service CVSS 4.0HIGH 8.7
- TI-2022-08947 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert… CVSS 3.1CRITICAL 9.8
- TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
- TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
- TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-56407 · CVE Program
- CVE-2026-56407 · NVD
- FIRST EPSS
- GHSA-r8qx-5vfx-8w6r · GitHub Advisory Database · CC BY 4.0
- CVE-2026-56407 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences