CVE-2026-56403
Full vulnerability record from the local CVENow database.
Description
libexpat before 2.8.2 has an integer overflow in storeAtts.
Severity
MEDIUM
CVSS score
6.9
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-21 16:16:26.590000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-56403",
"sourceIdentifier": "[email protected]",
"published": "2026-06-21T16:16:26.590",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libexpat before 2.8.2 has an integer overflow in storeAtts."
},
{
"lang": "es",
"value": "libexpat antes de 2.8.2 tiene un desbordamiento de entero en storeAtts."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "libexpat project",
"product": "libexpat",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2.8.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.4,
"impactScore": 5.5
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.4,
"impactScore": 5.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-22T17:05:33.081389Z",
"id": "CVE-2026-56403",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.8.2",
"matchCriteriaId": "E3A57811-3797-4D35-A4AC-E1AB3CE6F1F3"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/libexpat/libexpat/pull/1232",
"source": "[email protected]",
"tags": [
"Patch"
]
}
]
}