CVE-2026-56411 xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations

Description

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

Affected products and versions

Product	Affected versions	Fixed in
libexpat 2.8	earliest → < 2.8.2	2.8.2

Other CVEs of libexpat

The 26 CVEs of libexpat →

CVE-2026-76957 libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks 4.9 Medium CVE-2026-76956 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy,… 5.9 Medium CVE-2026-66046 Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the… 8.7 High CVE-2026-72522 libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the… 6.2 Medium