CVE-2026-118370
Published: October 30, 2026Last modified: November 4, 2026
Description
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.2 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity impact | LOW |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | expat | Unknown (2.5.0-r0) |
| 25 LTS | expat | Fixed (2.10.0-r0) | |
| Stream | expat | Fixed (2.10.0-r0) | |
| Hardened Containers | 23 LTS | expat | Unknown (2.5.0-r0) |
| 25 LTS | expat | Unknown (2.7.1-r0) | |
| Stream | expat | Unknown (2.4.9-r0) |
References
- https://github.com/libexpat/libexpat
- https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140
- https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae
- https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c
- https://github.com/libexpat/libexpat/pull/1450
- https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes