Executive brief
libexpat is a widely used C library for parsing XML data. A vulnerability in its 'xmlwf' utility could allow an attacker to cause a system crash or potentially execute unauthorized code by providing a specially crafted XML file. This could impact the reliability of applications processing external XML data and potentially lead to data breaches or service disruptions.
Technical details
An integer overflow vulnerability exists in the resolveSystemId function within the xmlwf utility of libexpat before version 2.8.2. The flaw occurs during the calculation of memory allocation size for absolute paths, specifically when processing external entity SYSTEM identifiers. On wide-character builds, the multiplication of string lengths by the character size can wrap around, leading to an undersized heap allocation. Subsequent string copy operations (tcscpy/tcscat) then result in a heap-based buffer overflow. An attacker could exploit this by providing a malicious XML file to be processed by xmlwf, potentially achieving arbitrary code execution or causing a denial of service. The issue is addressed in version 2.8.2.
Affected products
- libexpat project libexpat before 2.8.2
Timeline
- 2026-05-29: other: Initial patch proposed on GitHub
- 2026-05-31: patched: Fix merged into master branch
- 2026-06-21: disclosed: CVE published