CVE-2026-66046 Expat Denial of Service via storeAtts() Quadratic Complexity

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099462 advisory. libexpat before 2.8.2 has an integer overflow in storeAtts. Tenable has extracted the preceding description block directly from the Unity Linux security advisory. No...

libexpat before 2.8.2 has an integer overflow in storeAtts.

...

SUSE CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the storeAtts function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input that triggers the...

ALPINE-CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

UBUNTU-CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

CVE-2026-56403 affects libexpat prior to 2.8.2, with an integer overflow in storeAtts. Local attack vector, high complexity, no user interaction, requires no privileges. Impact: confidentiality and integrity likely high; availability low. Base score 6.9 (CVSS 3.1). No exploitation details or reme...

EUVD-2026-38180

libexpat before 2.8.2 has an integer overflow in storeAtts...

CVE-2026-56403

libexpat before 2.8.2 has an integer overflow in storeAtts...

Linux Distros Unpatched Vulnerability : CVE-2026-56403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat before 2.8.2 has an integer overflow in storeAtts. CVE-2026-56403 Note that Nessus relies on the presence of the package as reported by the vendor...

PT-2026-51239

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.2 Description An integer overflow exists in the storeAtts function. An integer overflow occurs when an arithmetic operation attempts to create a numeric value that is outside of the range that can be represented...

Unity Linux 20.1060e / 20.1070e Security Update: expat (UTSA-2026-017351)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017351 advisory. In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts function in xmlparse.c can lead to realloc misbehavior e.g., allocating too fe...