This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] libexpat fixes 13 vulnerabilities

The Expat XML parser fixes 13 vulnerabilities in version 2.8.2. Red Hat has released a fixed version of Red Hat Hardened Images for CVE-2026-56132 [1], and Debian has released a fix for the unstable sid and testing forky releases [2]. Selected vulnerabilities are described below, the others at [3].

libexpat - DoS (CVE-2026-56132)
CVSS 6.9 (Medium)

An unauthenticated local attacker can potentially, due to incorrect reallocation of a backing array for internal data structures when data structures are shared between parsers, read data without authorization, compromise its integrity or cause DoS [4].

The vulnerability is present in product:

  • libexpat; <2.8.2;

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

More information:

The vulnerability was publicly disclosed 19. 6. 2026.

libexpat - DoS, ACE (CVE-2026-56411)
CVSS 6.9 (Medium)

An unauthenticated local attacker can potentially, due to an integer overflow flaw when processing document type definitions with NOTATION declarations on 32-bit systems, compromise data integrity, cause DoS or execute arbitrary code [5] [6].

The vulnerability is present in product:

  • libexpat; <2.8.2;

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

More information:

The vulnerability was publicly disclosed 21. 6. 2026.

libexpat - DoS, ACE (CVE-2026-56406)
CVSS 6.9 (Medium)

An unauthenticated local attacker can potentially, due to an integer overflow flaw when parsing XML data from a buffer, caused by a missing check, compromise data integrity, cause DoS or execute arbitrary code [7].

The vulnerability is present in product:

  • libexpat; <2.8.2;

CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

More information:

The vulnerability was publicly disclosed 21. 7. 2025.

By CESNET, z.s.p.o. Táňa Macháčková on 3. 7. 2026.

CESNET, z.s.p.o. Logo