CVE-2026-118370: high-severity vulnerability in libexpat
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.4%
exploitation probability
0.4%top 62% of all CVEs
observed exploitation
nono source reports it
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
libexpat · libexpatRelated CVEs — libexpat
In the same product, most dangerous first.
CVE-2026-113351HIGHlibexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserResetEPSS 0.5%CVE-2026-115506HIGHlibexpat through 2.9.0 Denial of Service via Billion Laughs Detection DelayEPSS 0.5%CVE-2026-117610HIGHlibexpat through 2.9.0 NULL Pointer Dereference via External Entity SubparserEPSS 0.4%CVE-2026-93990HIGHExpat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked SurrogateEPSS 0.4%CVE-2026-102633HIGHlibexpat 2.7.2 through 2.8.5 Integer Overflow in expat_reallocEPSS 0.4%CVE-2026-76641HIGHExpat Out-of-Bounds Read via dtdCopyEPSS 0.4%
References
https://github.com/libexpat/libexpathttps://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750aehttps://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04chttps://github.com/libexpat/libexpat/pull/1450https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes