CVE-2026-118370

EUVD-2026-111546
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.31%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
libexpat_projectlibexpat
𝑥
≤ 2.9.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
expat
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
expat
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
trusty
needs-triage
xenial
needs-triage
apache2
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
trusty
not-affected
xenial
not-affected
apr-util
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
trusty
not-affected
xenial
not-affected
cmake
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
xenial
not-affected
ghostscript
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
xenial
not-affected
texlive-bin
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
xenial
not-affected
xmlrpc-c
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
trusty
needs-triage
xenial
needs-triage
vnc4
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
stonking
dne
trusty
needs-triage
xenial
needs-triage
wbxml2
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
xenial
needs-triage
swish-e
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
xenial
needs-triage
insighttoolkit4
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
resolute
dne
stonking
dne
xenial
needs-triage
cadaver
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
xenial
needs-triage
gdcm
bionic
needs-triage
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
trusty
not-affected
xenial
needs-triage
ayttm
jammy
dne
noble
dne
resolute
dne
stonking
dne
xenial
needs-triage
cableswig
jammy
dne
noble
dne
resolute
dne
stonking
dne
xenial
needs-triage
coin3
bionic
needs-triage
focal
not-affected
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
trusty
needs-triage
xenial
needs-triage
matanza
bionic
needs-triage
focal
ignored
jammy
ignored
noble
ignored
resolute
ignored
stonking
ignored
xenial
needs-triage
tdom
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
xenial
needs-triage
vtk
jammy
dne
noble
dne
resolute
dne
stonking
dne
trusty
needs-triage
xenial
needs-triage
smart
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
stonking
dne
xenial
needs-triage
firefox
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
thunderbird
jammy
not-affected
noble
not-affected
resolute
not-affected
stonking
not-affected
libxmltok
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
stonking
dne
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/libexpat/libexpat
https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140
https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae
https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c
https://github.com/libexpat/libexpat/pull/1450
https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes