By vendor

Libexpat_project vulnerabilities

Known CVEs affecting Libexpat_project products, prioritized by severity, with SEC.co remediation and detection guidance.

8 published vulnerabilities

• CVE-2026-56132MEDIUM 6.9

  CVE-2026-56132 is a heap-based buffer overflow vulnerability in libexpat, a widely-used XML parsing library. The flaw occurs in the XML prologue parsing logic when multiple parser instances share internal data structures—specifically, the scaffold backing array. Improper reallocation of this shared array can cause a heap buffer overflow, potentially allowing an attacker with local access to crash the application or execute arbitrary code. The vulnerability affects libexpat versions before 2.8.2.

• CVE-2026-56406MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its XML_ParseBuffer function. The vulnerability arises from a missing validation check that exists in a related function (XML_Parse), creating a code path that can trigger an integer overflow when processing certain XML inputs. An attacker with local access could exploit this to cause crashes or potentially execute code with elevated privileges, though remote exploitation is considered less feasible.

• CVE-2026-56407MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its entity handling logic. The flaw occurs when the library processes XML document preambles (the prologue section) and manages entity values. An attacker could exploit this by crafting a malicious XML file that, when parsed by an application using vulnerable versions of libexpat, may cause memory corruption leading to information disclosure or data tampering. This is a local attack requiring no special privileges, though exploitation requires specific conditions to manifest.

• CVE-2026-56411MEDIUM 6.9

  libexpat, a widely-used XML parsing library, contains an integer overflow vulnerability in its xmlwf utility when processing NOTATION declarations within DOCTYPE sections. An attacker who can supply a maliciously crafted XML file with specially constructed NOTATION declarations can trigger an integer overflow, potentially leading to memory corruption and code execution on the affected system. The vulnerability affects versions of libexpat before 2.8.2.

• CVE-2026-56409MEDIUM 6.5

  xmlwf, a command-line XML parser tool included in libexpat, contains an integer overflow vulnerability when processing the output directory parameter (-d). When a user specifies a custom output directory for parsed XML files, the tool miscalculates buffer sizes for the output filename, potentially allowing an attacker to corrupt memory and execute arbitrary code or crash the application. This vulnerability requires local system access and user interaction to trigger.

• CVE-2026-50219MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when certain XML parsing functions (XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset) are called from within event handlers without proper depth tracking. This can lead to memory safety violations and potentially allow attackers to crash applications or, in some scenarios, execute arbitrary code. The vulnerability requires local access and specific conditions to trigger, making it a moderate-risk issue rather than a widespread internet-facing threat.

• CVE-2026-56131MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in versions before 2.8.2. The flaw occurs when the XML_ResumeParser function is called from within a handler and a policy violation is detected. In such cases, the library fails to properly track the call stack depth, leaving freed memory accessible and potentially exploitable. This is analogous to an earlier vulnerability (CVE-2026-50219) in the same codebase.

• CVE-2026-56412MEDIUM 4.9

  libexpat, a widely-used XML parsing library, contains a use-after-free vulnerability in its CDATA section handling. The issue stems from incomplete depth tracking when handlers are invoked during XML processing, allowing memory already freed by one operation to be accessed by another. This affects versions before 2.8.2. While the immediate trigger requires specific XML policy violations and local system access, the underlying condition can lead to crashes or potentially arbitrary code execution if an attacker controls the malicious XML input.