Login Request a demo
Medium severity · published Oct 28, 2026
CVE-2026-118370
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
New
5.9
CVSS
–
EPSS
No
On KEV
Description
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
libexpat · libexpat
through 2.9.0 · source: vendor
Affected product
LI
libexpat
libexpat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118370
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118370
patch
https://github.com/libexpat/libexpat/pull/1450
patch
https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae
patch
https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c
technical-description
https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140
product
https://github.com/libexpat/libexpat
third-party-advisory
https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes
More from libexpat
8.2
CVE-2026-77214
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBuffer
7.5
CVE-2026-115506
libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
7.5
CVE-2026-93990
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
7.5
CVE-2026-76641
Expat Out-of-Bounds Read via dtdCopy
5.9
CVE-2026-117610
libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser