UpHeron
All vulnerabilities

Servers and applications

CVE-2026-118370

libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

Severity
High 8.2
Published
28 Oct 2026
Last changed
2 Nov 2026
Added to UpHeron
2 Nov 2026
Sources
NVD, CVE Program

Description

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

Affected software

SoftwareAffected versions
ExpatServers and applications · cna:libexpat|libexpat
  • Every version up to 2.9.0
ExpatServers and applications · cpe:a:libexpat_project:libexpat
  • Every version up to 2.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-118370
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-118370