# CVE-2026-102633: libexpat integer overflow in expat_realloc on 32-bit platforms

Source: https://junglewise.ai/threats/cve-2026-102633-libexpat-versions-2-7-2-through-2-8-5-contain-an-integer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102633 · Severity: medium · CVSS 5.9 · Published 2026-09-29

libexpat is an XML parsing library used in many applications to process XML documents. An integer overflow vulnerability in the memory allocation function on 32-bit systems allows attackers to trigger heap buffer overflow and memory corruption by supplying specially crafted XML files, potentially leading to denial of service or arbitrary code execution.

Vendors: [Libexpat](https://junglewise.ai/threats/vendors/libexpat).

## Quick answers

**Is CVE-2026-102633 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102633 being exploited in the wild.

**How severe is CVE-2026-102633?** Medium severity, with a CVSS score of 5.9, published 29 September 2026.

**Which products and versions are affected?** Libexpat Expat 2.7.2 through 2.8.5.

**Is there a fix for CVE-2026-102633?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102633 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102633?** Check whether you run Libexpat Expat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow in the expat_realloc() function on 32-bit platforms occurs when computing allocation sizes, allowing attackers to cause heap buffer overflow and memory corruption. The vulnerability is triggered through malicious XML input supplied to applications that parse with vulnerable libexpat versions. This results in denial of service or potential arbitrary code execution depending on the application context.

## Affected products

- libexpat expat 2.7.2 through 2.8.5

## Timeline

- 2026-09-29: disclosed

## References

- [https://github.com/libexpat/libexpat](https://github.com/libexpat/libexpat)
- [https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c](https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c)

## Related threats

- [Expat UTF-16 surrogate validation bypass](https://junglewise.ai/threats/cve-2026-93990-expat-through-2-8-4-fails-to-validate-low-surrogates-following)