CVE-2026-118370: libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
Affected Software
Event History
Frequently Asked Questions
What must an attacker provide to trigger the issue?
The attacker must be able to make the application parse a multi-gigabyte XML document containing a start tag with more than 2^30 attributes. Exploitation relies on those oversized attribute counts overflowing the attIndex and nPrefixes values in storeAtts().
What is the practical impact on an affected application?
A successful trigger can cause out-of-bounds writes, which may crash the application or corrupt heap memory. The provided data does not establish a specific code-execution outcome.
Are applications exposed if they parse untrusted XML?
Applications that parse attacker-supplied XML with affected libexpat versions are the relevant exposure scenario. The attacker does not need privileges or user interaction, but must be able to submit an exceptionally large, attribute-heavy document.