CVE-2026-56132
published 2026-06-19CVE-2026-56132: In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there…
PriorityP334medium6.9CVSS 3.1
AVLACHPRNUINSUCHIHAL
EPSS
0.11%
1.4th percentile
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | expat | — | — |
| debian | xmlrpc-c | — | — |
| libexpat_project | libexpat | < 2.8.2 | 2.8.2 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.16.9MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
ghsa_unreviewed·2026-06-19
CVE-2026-56132 [MEDIUM] CWE-821 In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
Red Hat
expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow
vendor_redhat·2026-06-19·CVSS 6.9
CVE-2026-56132 [MEDIUM] CWE-131 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow
expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly when multiple parsers share data. Successful exploitation could allow the attacker to execute arbitrary code, access sensitive information, or cause the application to crash, leading to a denial of service.
Package: expat (Re
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56132 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow [fedora-all]
bugzilla·2026-06-26·CVSS 6.9
CVE-2026-56132 [MEDIUM] CVE-2026-56132 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow [fedora-all]
CVE-2026-56132 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-56132 mingw-expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow [fedora-all]
bugzilla·2026-06-26·CVSS 6.9
CVE-2026-56132 [MEDIUM] CVE-2026-56132 mingw-expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow [fedora-all]
CVE-2026-56132 mingw-expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-56132 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow
bugzilla·2026-06-19·CVSS 6.9
CVE-2026-56132 [MEDIUM] CVE-2026-56132 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow
CVE-2026-56132 expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
2026-06-19
Published