# CVE-2026-56407: libexpat integer overflow in doProlog entity handling

Source: https://junglewise.ai/threats/cve-2026-56407-libexpat-integer-overflow-in-doprolog-entity-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-21. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56407 · Severity: medium · CVSS 6.9 · Published 2026-06-21

libexpat is a widely used library for parsing XML data in various software applications. A flaw in how it handles large internal entity declarations could allow an attacker to cause a system crash or potentially access sensitive information. This issue occurs when processing specially crafted XML files that contain extremely long entity values.

Technologies: [Libexpat Project Expat](https://junglewise.ai/threats/technologies/expat). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project).

## Quick answers

**Is CVE-2026-56407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56407 being exploited in the wild.

**How severe is CVE-2026-56407?** Medium severity, with a CVSS score of 6.9, published 21 June 2026.

**Which products and versions are affected?** Libexpat Project Expat before 2.8.2.

**Is there a fix for CVE-2026-56407?** A patch was published on 2026-06-03: Fix merged into master branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56407 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-56407?** Check whether you run Libexpat Project Expat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow exists in libexpat's 'doProlog' function, specifically within the 'storeEntityValue' logic. When processing internal entity declarations, the library stashes the replacement text length using a cast to a signed integer. If the entity value pool grows beyond INT_MAX, the 'textLen' value truncates to a negative integer. This causes subsequent entity references to calculate an incorrect 'textEnd' pointer that precedes the 'textPtr', resulting in an out-of-bounds buffer walk. The vulnerability is addressed in version 2.8.2 by capping the length before the integer cast.

## Affected products

- libexpat project libexpat before 2.8.2

## Timeline

- 2026-06-02: disclosed: Vulnerability reported via GitHub pull request after discovery through fuzzing.
- 2026-06-03: patched: Fix merged into master branch.
- 2026-06-21: advisory: CVE-2026-56407 published.

## References

- [https://github.com/libexpat/libexpat/pull/1262](https://github.com/libexpat/libexpat/pull/1262)

## Related threats

- [libexpat use-after-free in doCdataSection](https://junglewise.ai/threats/cve-2026-56412-libexpat-use-after-free-in-docdatasection)
- [libexpat integer overflow in xmlwf endDoctypeDecl](https://junglewise.ai/threats/cve-2026-56411-libexpat-integer-overflow-in-xmlwf-enddoctypedecl)
- [libexpat xmlwf integer overflow in resolveSystemId](https://junglewise.ai/threats/cve-2026-56410-libexpat-xmlwf-integer-overflow-in-resolvesystemid)
- [libexpat xmlwf integer overflow in output filename handling](https://junglewise.ai/threats/cve-2026-56409-libexpat-xmlwf-integer-overflow-in-output-filename-handling)
- [libexpat integer overflow in copyString](https://junglewise.ai/threats/cve-2026-56408-libexpat-integer-overflow-in-copystring)