CVE-2026-118370— libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

Quick assessment

Affected

libexpat libexpat

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libexpat 2.9.0 及更早版本在 lib/xmlparse.c 的 storeAtts() 函数中存在有符号整数溢出漏洞。攻击者可利用过大的属性数量触发越界写入。攻击者可提供一个数 GB 大小的文档，其中起始标签携带超过 2^30 个属性，从而导致 attIndex 和 nPrefixes 发生溢出，造成应用程序崩溃或堆内存损坏。

CVSS 5.9 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

Source: CVE Program / CVE List V5

Vulnerability Description

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

整数溢出或超界折返

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
libexpat	libexpat	0 ~ 2.9.0	-

II. Public POCs for CVE-2026-118370

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118370

请登录查看更多情报信息。

Vendor Pages for CVE-2026-118370 (1)

🔗 GitHub - libexpat/libexpat: :herb: Fast streaming XML parser written in C99 with >90% test coverage; moved from SourceForge to GitHub · GitHub product

Other References for CVE-2026-118370 (5)

https://github.com/libexpat/libexpat/pull/1450 patch issue-tracking
https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c patch
https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae patch
https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140 technical-description
https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-118370

IV. Related Vulnerabilities

Same product: libexpat

Same vendor: libexpat

Same weakness: CWE-190