EUVD-2026-60821

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-66046

Expat through 2.8.3 has quadratic complexity in storeAtts() in xmlparse.c when processing N attributes with non-normalized values, enabling remote unauthenticated DoS via a small XML document. CVSS 7.5 HIGH. No exploitation observed. Fix: upgrade to patched version (PR #1321).

CVE-2026-66046 Expat Denial of Service via storeAtts() Quadratic Complexity

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

libexpat before 2.8.2 has an integer overflow in storeAtts.

...

SUSE CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the storeAtts function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input that triggers the...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

ALPINE-CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

UBUNTU-CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

EUVD-2026-38180

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

CVE-2026-56403 affects libexpat prior to 2.8.2, with an integer overflow in storeAtts. Local attack vector, high complexity, no user interaction, requires no privileges. Impact: confidentiality and integrity likely high; availability low. Base score 6.9 (CVSS 3.1). No exploitation details or reme...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

Linux Distros Unpatched Vulnerability : CVE-2026-56403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat before 2.8.2 has an integer overflow in storeAtts. CVE-2026-56403 Note that Nessus relies on the presence of the package as reported by the vendor...

PT-2026-51239

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.2 Description An integer overflow exists in the storeAtts function. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, and Expat

In Expat also known as libexpat, before version 2.4.3, a left shift of 29 or more in the storeAtts function in xmlparse.c could lead to improper realloc behavior. This could result in allocating too few bytes, or only freeing memory after it was no longer needed...