CVE-2026-56404
Full vulnerability record from the local CVENow database.
Description
libexpat before 2.8.2 has an integer overflow in addBinding.
Severity
MEDIUM
CVSS score
6.9
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-21 16:16:27.620000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON
{
"id": "CVE-2026-56404",
"sourceIdentifier": "[email protected]",
"published": "2026-06-21T16:16:27.620",
"lastModified": "2026-10-25T23:10:00.167",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "libexpat before 2.8.2 has an integer overflow in addBinding."
},
{
"lang": "es",
"value": "libexpat antes de 2.8.2 tiene un desbordamiento de entero en addBinding."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "libexpat project",
"product": "libexpat",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2.8.2",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.4,
"impactScore": 5.5
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.4,
"impactScore": 5.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-22T17:04:59.811651Z",
"id": "CVE-2026-56404",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.8.2",
"matchCriteriaId": "E3A57811-3797-4D35-A4AC-E1AB3CE6F1F3"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/libexpat/libexpat/pull/1249",
"source": "[email protected]",
"tags": [
"Patch"
]
}
]
}