Is CVE-2026-66046 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66046 being exploited in the wild.

How severe is CVE-2026-66046?

High severity, with a CVSS score of 7.5, published 18 August 2026.

Is there a fix for CVE-2026-66046?

A patch was published on 2026-08-18: Fix merged in PR #1321 on libexpat master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66046 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-66046?

Check whether you run Libexpat Project Libexpat. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66046: Expat XML parser denial of service via quadratic complexity

CVE-2026-66046 · Severity: high · CVSS 7.5 · Published 2026-08-18

Expat is a widely-used XML parsing library found in many applications and operating systems. A vulnerability in how it processes XML attributes with certain characteristics causes the parser to consume excessive CPU time when handling specially crafted documents, allowing an attacker to crash or hang applications without special permissions. The attack requires only supplying a few megabytes of valid XML, making it trivial to exploit.

Technologies: Libexpat Project Libexpat. Vendors: Libexpat Project.

Quick answers

Is CVE-2026-66046 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66046 being exploited in the wild.
How severe is CVE-2026-66046?: High severity, with a CVSS score of 7.5, published 18 August 2026.
Which products and versions are affected?: Expat Expat through 2.8.3.
Is there a fix for CVE-2026-66046?: A patch was published on 2026-08-18: Fix merged in PR #1321 on libexpat master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66046 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-66046?: Check whether you run Libexpat Project Libexpat. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from quadratic algorithmic complexity (O(N²)) in the storeAtts() function in xmlparse.c, specifically in the default attribute CDATA status lookup. When processing N specified attributes that require normalization and have the maybeTokenized flag set, the function performs a linear scan of elementType->defaultAtts for each attribute, resulting in N² comparisons. An attacker can craft an XML document with many non-normalized attributes to trigger excessive CPU consumption on the parsing application. No authentication is required; the attack only requires the ability to supply an XML document to a parser. A fix has been merged upstream migrating the linear lookup to hash table lookups to eliminate the quadratic behavior.

Affected products

Expat Expat through 2.8.3

Timeline

2026-08-18: disclosed
2026-08-18: patched: Fix merged in PR #1321 on libexpat master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.