6.9
Medium
CVE-2026-56407 libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen
Description
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libexpat 2.8 | earliest → < 2.8.2 | 2.8.2 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of libexpat
The 26 CVEs of libexpat →
CVE-2026-76957
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks
4.9
Medium
CVE-2026-76956
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy,…
5.9
Medium
CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the…
8.7
High
CVE-2026-72522
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the…
6.2
Medium