CVE-2026-76956

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in the expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

An issue was discovered in libexpat before 2.6.3, where xmlparse.c does not reject a negative length for XML_ParseBuffer.

The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat versions 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory due to an untrusted search path, known as DLL hijacking.

Issue in libexpat before version 2.6.4. The XML_ResumeParser function can crash if XML_StopParser stops/suspends an unstarted parser.

An issue was discovered in libexpat before version 2.6.3, which can lead to an integer overflow in the nextScaffoldPart function in xmlparse.c on 32-bit platforms.

An issue was discovered in libexpat before version 2.6.3 related to integer overflow in the dtdCopy function in xmlparse.c. This issue occurs on 32-bit platforms where UINT_MAX equals SIZE_MAX.

XML External Entity vulnerability in libexpat 2.2.0 and earlier allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, leading to out-of-bounds reads and disclosure of adjacent heap memory, including heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR.

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.