libexpat: Integer overflow in storeAtts leads to out-of-bounds write
Summary
libexpat through 2.9.0 contains a signed integer overflow in the storeAtts() function that can lead to out-of-bounds writes. An attacker can supply a very large XML document with a start tag containing more than 2^30 attributes, which can crash the application or corrupt heap memory. Exposure mainly concerns applications that parse XML from untrusted sources.
Affected
- libexpat up to and including 2.9.0
- Applications and distributions that bundle or link affected libexpat versions (for example Debian bookworm and trixie packages)
Fixed in
Unknown. Upstream commits from PR #1450 address the issue, but no confirmed fixed release is known at the time of writing. Check the Expat changelog and release page before deploying a version.
Workaround
- Enforce size limits on XML requests from untrusted sources at the reverse proxy or application
- Reject XML from untrusted sources where it is not needed
- Track updates for every application that bundles libexpat
Exploitation
- No known exploitation reported.
- No public proof of concept found.
- Not found in CISA KEV in our searches.
Our recommendation
- Inventory applications that use libexpat, including bundled copies.
- Check whether these applications parse XML from untrusted sources and restrict that exposure.
- Apply size limits on public XML endpoints now.
- Install the vendor fix as soon as it is released and verified, and monitor the Expat project and your distribution advisories.
- Note that the CVSS scores differ between sources (8.2 in CVSS 4.0, 5.9 and 5.3 in other records).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Upstream commit 621cb2c7 github.com
- Upstream commit 1bac53c4 github.com
- Upstream pull request #1450 github.com
- Debian security tracker security-tracker.debian.org
- Ubuntu security notice ubuntu.com
- Offseq threat radar radar.offseq.com
- Expat project libexpat.github.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:47.
Original description (NVD)
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
NVD references (6)
- https://github.com/libexpat/libexpat
- https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138…
- https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae
- https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c
- https://github.com/libexpat/libexpat/pull/1450
- https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-np…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.