Executive brief
libexpat is a widely used library for processing XML data. A flaw in its 'xmlwf' utility could allow an attacker to cause a system crash or potentially execute unauthorized code when the tool is used to process files with specifically crafted long names. This could impact the reliability of automated data processing pipelines or lead to unauthorized access if the utility is used in a sensitive environment.
Technical details
An integer overflow vulnerability exists in the xmlwf utility of libexpat before version 2.8.2. The root cause is located in the main() function where the size calculation for the output path—combining the directory name and filename—is performed without proper overflow guards during addition and multiplication. When processing extremely long filenames with the '-d' (output directory) flag, the calculated buffer size can wrap around, leading to a heap-based buffer overflow during subsequent string copy operations (tcscpy/tcscat). An attacker could exploit this by providing a specially crafted filename to the utility, potentially achieving arbitrary code execution or a denial-of-service. The issue is fixed in version 2.8.2 by implementing SIZE_MAX guards.
Affected products
- libexpat project libexpat before 2.8.2
Timeline
- 2026-06-01: patched: Fix merged into master branch via Pull Request 1259
- 2026-06-21: advisory: CVE-2026-56409 published