Executive brief
libexpat is a widely used library for parsing XML data in various software applications. A flaw in how it handles large internal entity declarations could allow an attacker to cause a system crash or potentially access sensitive information. This issue occurs when processing specially crafted XML files that contain extremely long entity values.
Technical details
An integer overflow exists in libexpat's 'doProlog' function, specifically within the 'storeEntityValue' logic. When processing internal entity declarations, the library stashes the replacement text length using a cast to a signed integer. If the entity value pool grows beyond INT_MAX, the 'textLen' value truncates to a negative integer. This causes subsequent entity references to calculate an incorrect 'textEnd' pointer that precedes the 'textPtr', resulting in an out-of-bounds buffer walk. The vulnerability is addressed in version 2.8.2 by capping the length before the integer cast.
Affected products
- libexpat project libexpat before 2.8.2
Timeline
- 2026-06-02: disclosed: Vulnerability reported via GitHub pull request after discovery through fuzzing.
- 2026-06-03: patched: Fix merged into master branch.
- 2026-06-21: advisory: CVE-2026-56407 published.