Executive brief
libexpat is a widely used software library for processing XML data. A flaw in how it handles memory allocation for strings could allow an attacker to cause a system crash or potentially gain unauthorized access to data. This affects any application that relies on libexpat to parse untrusted XML content.
Technical details
An integer overflow vulnerability exists in the copyString function within libexpat's xmlparse.c. The issue occurs when calculating the memory required for a string copy (charsRequired * sizeof(XML_Char)), which can overflow if the input string is sufficiently large. This can lead to an undersized memory allocation followed by a heap-based buffer overflow. An attacker could exploit this via a local vector to cause a denial of service or achieve arbitrary code execution, though the high attack complexity suggests specific conditions must be met. The vulnerability is addressed in version 2.8.2 by adding a check against SIZE_MAX.
Affected products
- libexpat project libexpat before 2.8.2
Timeline
- 2026-06-21: disclosed
- 2026-06-21: advisory