Executive brief
libexpat is a widely used software library for parsing XML data in various applications and operating systems. A vulnerability in how it handles document attributes could allow an attacker to cause an integer overflow, potentially leading to data corruption or unauthorized system access. This issue primarily affects local systems where malicious XML files are processed by vulnerable software.
Technical details
An integer overflow vulnerability (CWE-190) exists in the 'storeAtts' function within libexpat's xmlparse.c before version 2.8.2. The flaw occurs when calculating lengths for attribute prefixes and URIs, where signed integer arithmetic can wrap around if provided with specially crafted XML input. An attacker with the ability to provide local XML files for parsing could exploit this to cause memory corruption, potentially leading to a compromise of confidentiality and integrity. The issue is addressed in version 2.8.2 by adding explicit bounds checks against INT_MAX before performing addition and subtraction on length variables.
Affected products
- libexpat project libexpat before 2.8.2
Timeline
- 2026-05-22: patched: Fix merged into master branch
- 2026-06-21: disclosed: CVE published