CVE-2026-56408
published 2026-06-21CVE-2026-56408: libexpat before 2.8.2 has an integer overflow in copyString.
PriorityP432medium6.9CVSS 3.1
AVLACHPRNUINSUCHIHAL
EPSS
0.13%
2.2th percentile
libexpat before 2.8.2 has an integer overflow in copyString.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| libexpat_project | libexpat | < 2.8.2 | 2.8.2 |
| ubuntu | expat | — | — |
CVSS provenance
nvdv3.16.9MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
libexpat before 2.8.2 has an integer overflow in copyString.
ghsa_unreviewed·2026-06-21
CVE-2026-56408 [MEDIUM] CWE-190 libexpat before 2.8.2 has an integer overflow in copyString.
libexpat before 2.8.2 has an integer overflow in copyString.
VulDB
libexpat up to 2.8.1 integer overflow (EUVD-2026-38185)
vuldb·2026-06-21·CVSS 6.9
CVE-2026-56408 [MEDIUM] libexpat up to 2.8.1 integer overflow (EUVD-2026-38185)
A vulnerability was found in libexpat up to 2.8.1 and classified as problematic. The affected element is an unknown function. The manipulation results in integer overflow.
This vulnerability is reported as CVE-2026-56408. The attack requires a local approach. No exploit exists.
It is suggested to upgrade the affected component.
Ubuntu
Expat vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 7.5
CVE-2026-50219 [HIGH] Expat vulnerabilities
Title: Expat vulnerabilities
Summary: Several security issues were fixed in Expat.
It was discovered that Expat could be made to allocate large amounts of
memory when parsing a small crafted document. An attacker could possibly
use this issue to cause Expat to consume resources, leading to a denial of
service. This issue was only addressed in Ubuntu 24.04 LTS.
(CVE-2025-59375)
It was discovered that Expat incorrectly handled empty external parameter
entity content. An attacker could possibly use this issue to cause Expat to
crash, resulting in a denial of service. (CVE-2026-32776)
It was discovered that Expat incorrectly handled certain DTD content. An
attacker could possibly use this issue to cause Expat to enter an infinite
loop, resulting in a denial of service. (CVE-2026-32777)
It
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-21
Published