CVE-2026-118370

What it actually does

Signed integer overflow in storeAtts() allows oversized attribute counts in XML start tags to overflow attIndex and nPrefixes, resulting in out-of-bounds writes on the heap.

Why it matters to the business

Applications that parse untrusted XML may crash or experience memory corruption, leading to denial of service or potential arbitrary code execution in affected libraries and downstream software.

How an attack unfolds

An attacker crafts a multi-gigabyte XML document containing a start tag with more than 2^30 attributes and supplies it to any application using the vulnerable libexpat parser, triggering the integer overflow during attribute storage and subsequent heap corruption.

How to fix it

Upgrade libexpat to a version containing the fix for the integer overflow in storeAtts(); rebuild and redeploy all dependent applications; consider input size limits on XML documents as a temporary control.

How to confirm the fix worked

Confirm libexpat version is newer than 2.9.0; attempt parsing of a test document with an attribute count exceeding 2^30 to verify absence of crash or corruption.

Typical attack path

1. Identify target application that accepts XML input via network or file upload
2. Generate XML document with start tag containing over 2^30 attributes totaling multiple gigabytes
3. Deliver the malicious document to the target parser
4. Trigger storeAtts() processing to induce signed integer overflow and out-of-bounds write
5. Observe crash or attempt to leverage heap corruption for code execution

How to detect it

Review application logs for crashes during XML parsing of unusually large inputs; inspect process dumps for heap corruption patterns around attribute index handling; correlate with inbound XML traffic exceeding normal size thresholds.

What your security team should do

• Inventory all software using libexpat and prioritize upgrades
• Implement XML input validation and size restrictions where feasible
• Monitor for new fixed releases and apply within 30 days given public disclosure
• Add memory sanitizer tests for XML parsing paths in CI pipelines