CVE-2026-118370

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.9.1

Description A signed integer overflow exists in the storeAtts() function within lib/xmlparse.c. An attacker can trigger out-of-bounds writes by providing a multi-gigabyte document containing a start tag with more than 2^30 attributes. This action overflows the attIndex and nPrefixes variables, which can lead to application crashes or heap memory corruption.

Recommendations Update libexpat to version 2.9.1 or later. As a temporary mitigation, restrict the processing of oversized XML documents with an excessive number of attributes.