Integer overflow in libexpat storeAtts can corrupt heap memory
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
libexpat through 2.9.0 contains a signed integer overflow in storeAtts() in lib/xmlparse.c (CWE-190). Oversized attribute counts overflow the attIndex and nPrefixes values, which leads to out-of-bounds writes. An attacker who supplies a multi-gigabyte XML document with a start tag carrying over 2^30 attributes can crash applications or corrupt heap memory.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| libexpat project | libexpat | up to 2.9.0 | — | No fix listed | CNA |
- libexpat Vendorlibexpat project Affected up to 2.9.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* | up to 2.9.0 | Vulnerable | libexpat project |
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions up to 2.9.0 Vulnerable ·libexpat project
Remediation
The sources list no fixed version for libexpat. Red Hat lists a plan of none available for Red Hat Enterprise Linux 7, 8, 9 and 10, Red Hat Hardened Images and Red Hat OpenShift Container Platform 4, and no fix planned for Red Hat Enterprise Linux 6.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Hardened Images | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118370
- 2026-10-28 Alias added: GHSA-c6pw-vjr4-wwwr
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-11-02 CVSS score added · NVD
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
References
Patch 3
More libexpat project Libexpat vulnerabilities
- TI-2022-09008 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVSS 3.1CRITICAL 9.8
- TI-2026-79488 Billion laughs detection delay in libexpat enables denial of service CVSS 4.0HIGH 8.7
- TI-2022-08947 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert… CVSS 3.1CRITICAL 9.8
- TI-2021-20962 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the… CVSS 3.1HIGH 8.8
- TI-2021-21076 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. CVSS 3.1HIGH 8.1
- TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-118370 · CVE Program
- CVE-2026-118370 · NVD
- FIRST EPSS
- GHSA-c6pw-vjr4-wwwr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118370 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences