CVE-2026-102633CWE-190

CVE-2026-102633

Medium · published September 29, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00348 · 27.2th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-09-29T21:17Z
References (5)
https://github.com/libexpat/libexpat · [email protected]https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003 · [email protected]https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118 · [email protected]https://github.com/libexpat/libexpat/pull/1392 · [email protected]https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 16:04Z
    libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
    cvelistv5