Executive brief
libexpat is a widely used software library for parsing XML data. A vulnerability was found where processing specially crafted XML files could cause the library to crash or potentially allow unauthorized access to data. This occurs when the library incorrectly manages memory while sharing data structures between different parts of the parsing process.
Technical details
A heap-based buffer overflow exists in the doProlog function within xmlparse.c of libexpat before version 2.8.2. The vulnerability is caused by the mishandling of scaffold backing array reallocations when data structures (specifically the DTD struct) are shared between a parent parser and an external parameter-entity sub-parser. A sub-parser with shallower nesting can trigger a REALLOC that shrinks the shared scaffIndex buffer; when the parent parser resumes, it may attempt to write to the buffer based on its own (larger) tracking variable, leading to an out-of-bounds write. This issue is tracked as CWE-821 (Incorrect Synchronization) and has been patched in version 2.8.2.
Affected products
- libexpat project libexpat before 2.8.2
Timeline
- 2026-06-11: disclosed: Pull request submitted to fix the issue
- 2026-06-19: advisory: CVE published and NVD record created
- 2026-06-20: patched: Fix merged into master branch for version 2.8.2