Executive brief
A vulnerability exists in libexpat, a widely used library for parsing XML data. An attacker could provide a specially crafted XML file that causes the software to miscalculate memory requirements, potentially leading to a system crash or unauthorized data access. This affects applications that use the xmlwf tool to process untrusted XML documents.
Technical details
An integer overflow vulnerability exists in the xmlwf utility of libexpat within the endDoctypeDecl() function. The root cause is the use of a plain integer to count NOTATION declarations from a Document Type Definition (DTD), followed by a memory allocation (malloc) that multiplies this count by the size of a pointer without overflow guards. On 32-bit systems, this multiplication can wrap around, leading to a heap-based buffer under-allocation. A subsequent loop that populates this buffer can then result in a heap buffer overflow. The vulnerability is addressed in version 2.8.2 by switching the counter to size_t and implementing proper overflow checks.
Affected products
- libexpat project libexpat before 2.8.2
Timeline
- 2026-06-02: disclosed: Vulnerability details shared in pull request
- 2026-06-03: patched: Fix merged into master branch
- 2026-06-21: advisory: CVE-2026-56411 published