libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
Priority LOW 36CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 8 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 8 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| libexpat project | libexpat | 2.7.2 – 2.8.5 | — | No fix listed | CNA |
- libexpat Vendorlibexpat project Affected 2.7.2 – 2.8.5 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* | — | — | libexpat project |
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions — — ·libexpat project
Remediation
Red Hat 6 advisories
- RHSA-2026:95365 Released 2026-11-04 · Red Hat rating CriticalRed Hat Cost Management On-Premise container image update
- Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
- RHSA-2026:94802 Released 2026-11-04 · Red Hat rating CriticalA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2026:92323 Released 2026-10-30 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-6.el8_10, expat-devel-2.5.0-6.el8_10
Show 3 more Red Hat advisories
- RHSA-2026:89907 Released 2026-10-26 · Red Hat rating CriticalRed Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:88247 Released 2026-10-22 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux AppStream (v. 9) expat-devel-2.5.0-6.el9_8.7
- Red Hat Enterprise Linux BaseOS (v. 9) expat-2.5.0-6.el9_8.7
- RHSA-2026:88248 Released 2026-10-22 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux AppStream (v. 10) expat-devel-2.7.3-1.el10_2.7
- Red Hat Enterprise Linux BaseOS (v. 10) expat-2.7.3-1.el10_2.7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat Cost Management On-Premise 1 | Fixed | RHSA-2026:95365 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:94802 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:88248 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:88247 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:88248 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:92323 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:88247 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:89907 |
Not affected: 2 products
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102633
- 2026-10-03 Alias added: GHSA-533f-rf84-jgcc
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88247 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88248 · Red Hat
- 2026-10-23 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 10) +1 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:89907 · Red Hat
- 2026-10-30 Fix available: Red Hat Update Infrastructure 5 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92323 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
- 2026-11-04 Fix available: RHSA-2026:94802 · Red Hat
- 2026-11-04 Fix available: Red Hat Discovery 2 · Red Hat
- 2026-11-05 Fix available: Red Hat Cost Management On-Premise 1 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:95365 · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
More libexpat project vulnerabilities
- TI-2022-09008 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVSS 3.1CRITICAL 9.8
- TI-2026-79488 Billion laughs detection delay in libexpat enables denial of service CVSS 4.0HIGH 8.7
- TI-2022-08947 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert… CVSS 3.1CRITICAL 9.8
- TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
- TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
- TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-102633 · CVE Program
- CVE-2026-102633 · NVD
- FIRST EPSS
- GHSA-533f-rf84-jgcc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-102633 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences