Live › vulnerability › CVE-2026-118370
Go to dashboardlibexpat, the XML parser library, has a signed integer overflow in storeAtts() that an attacker can trigger with a multi-gigabyte XML document containing a start tag with over 2^30 attributes. The result is an out-of-bounds heap write that crashes the application or corrupts memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Any application that links libexpat and parses XML from untrusted input is exposed, including through language runtimes and tools that bundle it. Systems that only parse trusted, local XML files are much less exposed. The sources do not say which default configurations or parser entry points reach the vulnerable code.
No product ranges from the sources yet.
pkg-config --modversion expat or check the bundled libexpat version in each application that parses XML from untrusted sources.2.9.0 once the upstream fix is published; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-118370")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.