{"id":"CVE-2026-118370","kind":"vulnerability","aliases":["CVE-2026-118370"],"related":[],"title":"libexpat: attribute count overflow lets crafted XML corrupt heap memory","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.","summary":"libexpat, the XML parser library, has a signed integer overflow in storeAtts() that an attacker can trigger with a multi-gigabyte XML document containing a start tag with over 2^30 attributes. The result is an out-of-bounds heap write that crashes the application or corrupts memory.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","libexpat","linux-distros","package","php","python","xml-parsing"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Run `pkg-config --modversion expat` or check the bundled libexpat version in each application that parses XML from untrusted sources.\n- Find which services parse XML from outside the network, such as uploads, feeds, SOAP or SAML endpoints.","fix":"- Upgrade libexpat to a release later than `2.9.0` once the upstream fix is published; the sources do not name the fixed version.\n- Apply distribution or vendor libexpat updates as they ship.","status":"open","published_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:26+00:00","updated_at":"2026-10-28T03:32:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T03:32:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade libexpat to a release later than `2.9.0` once the upstream fix is published; the sources do not name the fixed version.\n- Apply distribution or vendor libexpat updates as they ship.","reach":"internet","title":"libexpat: attribute count overflow lets crafted XML corrupt heap memory","impact":"high","summary":"libexpat, the XML parser library, has a signed integer overflow in storeAtts() that an attacker can trigger with a multi-gigabyte XML document containing a start tag with over 2^30 attributes. The result is an out-of-bounds heap write that crashes the application or corrupts memory.","category":"package","nicknames":[],"who_cares":["libexpat","xml-parsing","c","linux-distros","python","php"],"confidence":0.5,"needs_auth":"no","worst_case":"Attacker corrupts heap memory or crashes the parsing process remotely.","analyst_note":"Check the NVD entry and the libexpat upstream advisory for the fixed version and whether the overflow is reachable with default parser settings.","how_to_check":"- Run `pkg-config --modversion expat` or check the bundled libexpat version in each application that parses XML from untrusted sources.\n- Find which services parse XML from outside the network, such as uploads, feeds, SOAP or SAML endpoints.","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Any application that links libexpat and parses XML from untrusted input is exposed, including through language runtimes and tools that bundle it. Systems that only parse trusted, local XML files are much less exposed. The sources do not say which default configurations or parser entry points reach the vulnerable code.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":3367,"output_tokens":620,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118370':13A,16A '-2026':12A,15A '2':58B,119C '2.9.0':80C '30':59B,120C 'allow':92C 'applic':74B,128C 'attack':42B,93C,105C 'attindex':124C 'attribut':2A,60B,103C,121C 'bound':68B,99C 'c':17B 'carri':117C 'contain':52B,81C 'corrupt':8A,76B,130C 'count':3A,104C 'craft':6A 'crash':72B,127C 'cve':11A,14A 'distro':21B 'document':51B,112C 'gigabyt':49B,111C 'heap':9A,69B,131C 'integ':36B,84C 'let':5A 'lib/xmlparse.c':90C 'libexpat':1A,18B,28B,78C 'librari':32B 'linux':20B 'linux-distro':19B 'memori':10A,77B,132C 'multi':48B,110C 'multi-gigabyt':47B,109C 'nprefix':126C 'out-of-bound':65B,96C 'overflow':4A,37B,85C,123C 'overs':102C 'packag':22B 'pars':27B 'parser':31B 'php':23B 'python':24B 'result':62B 'sign':35B,83C 'start':54B,115C 'storeatt':39B,88C 'suppli':107C 'tag':55B,116C 'trigger':44B,95C 'via':101C 'vulner':86C 'write':70B,100C 'xml':7A,26B,30B,50B 'xml-pars':25B","nicknames":[],"mitigations":[],"who_affected":"Any application that links libexpat and parses XML from untrusted input is exposed, including through language runtimes and tools that bundle it. Systems that only parse trusted, local XML files are much less exposed. The sources do not say which default configurations or parser entry points reach the vulnerable code.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","severity":null,"published_at":"2026-10-28T03:17:13+00:00","modified_at":"2026-10-28T03:17:13+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}