CVE-2026-118370
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
CVE-2026-118370- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-111546
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
EUVD-2026-111546- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c6pw-vjr4-wwwr
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib...
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
GHSA-c6pw-vjr4-wwwr- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
CVE-2026-118370- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-190
- Updated
- 2026-11-03
OSVALPINE-CVE-2026-118370
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
ALPINE-CVE-2026-118370- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
OSVBELL-CVE-2026-118370
- Record
BELL-CVE-2026-118370- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-05
Show 6 moreShow less
OSV
libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
CVE-2026-118370- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-190
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-118370
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
DEBIAN-CVE-2026-118370- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-08
OSVUBUNTU-CVE-2026-118370
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
UBUNTU-CVE-2026-118370- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVAZL-111148 No score
CVE-2026-118370 affecting package expat 2.9.0-1
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
AZL-111148- Updated
- 2026-11-05
OSVAZL-111851 No score
CVE-2026-118370 affecting package cmake 3.30.3-15
libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
- Record
AZL-111851- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12396-1 No score
expat-2.10.0-1.1 on GA media
These are all security issues fixed in the expat-2.10.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12396-1- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
expatAlpine:v3.21 |
before 2.10.0-r0 | 2.10.0-r0 |
expatAlpine:v3.22 |
before 2.10.0-r0 | 2.10.0-r0 |
expatAlpine:v3.23 |
before 2.10.0-r0 | 2.10.0-r0 |
expatAlpine:v3.24 |
before 2.10.0-r0 | 2.10.0-r0 |
expatAzure Linux:3 |
through 2.9.0-1 | None known |
cmakeAzure Linux:3 |
through 3.30.3-15 | None known |
expatAlpaquita:25 |
2.7.1-r0 up to 2.10.0-r0 | 2.10.0-r0 |
expatAlpaquita:stream |
2.4.9-r0 up to 2.10.0-r0 | 2.10.0-r0 |
expatBellSoft Hardened Containers:25 |
2.7.1-r0 up to 2.10.0-r0 | 2.10.0-r0 |
expatBellSoft Hardened Containers:stream |
2.4.9-r0 up to 2.10.0-r0 | 2.10.0-r0 |
Show 78 moreShow less
| Package | Affected | Fixed |
|---|---|---|
expatDebian:12 |
All versions, plus listed versions 2.10.0-12.5.0-12.5.0-1+deb12u12.5.0-1+deb12u22.5.0-1+deb12u3 Show 32 moreShow less2.5.0-1+deb12u42.5.0-1+deb12u52.5.0-22.6.0-12.6.1-12.6.1-22.6.2-12.6.2-22.6.3-12.6.3-22.6.4-12.7.0-12.7.1-12.7.1-22.7.2-12.7.3-12.7.3-22.7.4-12.7.5-12.8.0-12.8.0-22.8.1-12.8.2-12.8.2-1~deb13u12.8.3-12.8.3-1~deb13u12.8.4-12.8.4-22.8.5-12.8.5-22.9.0-12.9.0-1~deb13u1 |
None known |
expatDebian:13 |
All versions, plus listed versions 2.10.0-12.7.1-22.7.2-12.7.3-12.7.3-2 Show 15 moreShow less2.7.4-12.7.5-12.8.0-12.8.0-22.8.1-12.8.2-12.8.2-1~deb13u12.8.3-12.8.3-1~deb13u12.8.4-12.8.4-22.8.5-12.8.5-22.9.0-12.9.0-1~deb13u1 |
None known |
expatDebian:14 |
before 2.10.0-1, plus listed versions 2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-1 Show 14 moreShow less2.7.5-12.8.0-12.8.0-22.8.1-12.8.2-12.8.2-1~deb13u12.8.3-12.8.3-1~deb13u12.8.4-12.8.4-22.8.5-12.8.5-22.9.0-12.9.0-1~deb13u1 |
2.10.0-1 |
coin3Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2 |
None known |
expatUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3 Show 12 moreShow less2.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm22.1.0-4ubuntu1.4+esm42.1.0-4ubuntu1.4+esm62.1.0-4ubuntu1.4+esm72.1.0-4ubuntu1.4+esm82.1.0-4ubuntu1.4+esm92.1.0-4ubuntu1.4+esm102.1.0-4ubuntu1.4+esm112.1.0-4ubuntu1.4+esm122.1.0-4ubuntu1.4+esm13 |
None known |
vnc4Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1 |
None known |
vtkUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1 |
None known |
xmlrpc-cUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1 |
None known |
expatUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.4 Show 12 moreShow less2.1.0-7ubuntu0.16.04.52.1.0-7ubuntu0.16.04.5+esm22.1.0-7ubuntu0.16.04.5+esm52.1.0-7ubuntu0.16.04.5+esm62.1.0-7ubuntu0.16.04.5+esm72.1.0-7ubuntu0.16.04.5+esm82.1.0-7ubuntu0.16.04.5+esm92.1.0-7ubuntu0.16.04.5+esm102.1.0-7ubuntu0.16.04.5+esm112.1.0-7ubuntu0.16.04.5+esm122.1.0-7ubuntu0.16.04.5+esm132.1.0-7ubuntu0.16.04.5+esm14 |
None known |
ayttmUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.6.3-3build10.6.3-3ubuntu0.1~esm1 |
None known |
cableswigUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1 |
None known |
cadaverUbuntu:16.04:LTS |
All versions, plus listed versions 0.23.3-2ubuntu2 |
None known |
coin3Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2 |
None known |
gdcmUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.4-42.4.4-4build12.4.4-4ubuntu12.6.1-32.6.2-1 Show 7 moreShow less2.6.2-22.6.2-32.6.3-12.6.3-1ubuntu12.6.3-2ubuntu12.6.3-3ubuntu12.6.3-3ubuntu3 |
None known |
insighttoolkit4Ubuntu:16.04:LTS |
All versions, plus listed versions 4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1 |
None known |
libxmltokUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2-3build31.2-3ubuntu0.1~esm11.2-3ubuntu0.16.04.1~esm11.2-3ubuntu0.16.04.1~esm21.2-3ubuntu0.16.04.1~esm31.2-3ubuntu0.16.04.1~esm41.2-3ubuntu0.16.04.1~esm5 |
None known |
matanzaUbuntu:16.04:LTS |
All versions, plus listed versions 0.13+ds1-5 |
None known |
smartUbuntu:16.04:LTS |
All versions, plus listed versions 1.4-2 |
None known |
swish-eUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1 |
None known |
tdomUbuntu:16.04:LTS |
All versions, plus listed versions 0.8.3-1 |
None known |
vnc4Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1 |
None known |
vtkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1 |
None known |
wbxml2Ubuntu:16.04:LTS |
All versions, plus listed versions 0.10.7-1 |
None known |
xmlrpc-cUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1 |
None known |
expatUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.1 Show 10 moreShow less2.2.5-3ubuntu0.22.2.5-3ubuntu0.42.2.5-3ubuntu0.72.2.5-3ubuntu0.82.2.5-3ubuntu0.92.2.5-3ubuntu0.9+esm12.2.5-3ubuntu0.9+esm22.2.5-3ubuntu0.9+esm32.2.5-3ubuntu0.9+esm42.2.5-3ubuntu0.9+esm5 |
None known |
cadaverUbuntu:18.04:LTS |
All versions, plus listed versions 0.23.3-2ubuntu3 |
None known |
coin3Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1 |
None known |
gdcmUbuntu:18.04:LTS |
All versions, plus listed versions 2.8.2-3build12.8.3-12.8.4-12.8.4-1build2 |
None known |
insighttoolkit4Ubuntu:18.04:LTS |
All versions, plus listed versions 4.12.2-dfsg1-1ubuntu1 |
None known |
libxmltokUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.2-41.2-4ubuntu0.18.04.1~esm11.2-4ubuntu0.18.04.1~esm21.2-4ubuntu0.18.04.1~esm31.2-4ubuntu0.18.04.1~esm41.2-4ubuntu0.18.04.1~esm51.2-4ubuntu0.18.04.1~esm61.2-4ubuntu0.18.04.1~esm7 |
None known |
matanzaUbuntu:18.04:LTS |
All versions, plus listed versions 0.13+ds1-5build10.13+ds1-6 |
None known |
smartUbuntu:18.04:LTS |
All versions, plus listed versions 1.4-2 |
None known |
swish-eUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4.7-5ubuntu12.4.7-5ubuntu1+esm1 |
None known |
tdomUbuntu:18.04:LTS |
All versions, plus listed versions 0.8.3-10.9.0-1 |
None known |
vnc4Ubuntu:18.04:LTS |
All versions, plus listed versions 4.1.1+xorg4.3.0-37.3ubuntu2 |
None known |
wbxml2Ubuntu:18.04:LTS |
All versions, plus listed versions 0.10.7-10.10.7-1build1 |
None known |
xmlrpc-cUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1 |
None known |
expatUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.2.7-22.2.9-12.2.9-1build12.2.9-1ubuntu0.22.2.9-1ubuntu0.4 Show 7 moreShow less2.2.9-1ubuntu0.52.2.9-1ubuntu0.62.2.9-1ubuntu0.72.2.9-1ubuntu0.82.2.9-1ubuntu0.8+esm12.2.9-1ubuntu0.8+esm22.2.9-1ubuntu0.8+esm3 |
None known |
cadaverUbuntu:20.04:LTS |
All versions, plus listed versions 0.23.3-2.1build1 |
None known |
insighttoolkit4Ubuntu:20.04:LTS |
All versions, plus listed versions 4.12.2-dfsg1-4.1ubuntu14.13.2-dfsg1-1ubuntu14.13.2-dfsg1-4ubuntu14.13.2-dfsg1-64.13.2-dfsg1-6ubuntu14.13.2-dfsg1-8 |
None known |
libxmltokUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.2-41.2-4ubuntu0.20.04.1~esm11.2-4ubuntu0.20.04.1~esm21.2-4ubuntu0.20.04.1~esm31.2-4ubuntu0.20.04.1~esm41.2-4ubuntu0.20.04.1~esm51.2-4ubuntu0.20.04.1~esm61.2-4ubuntu0.20.04.1~esm7 |
None known |
matanzaUbuntu:20.04:LTS |
All versions, plus listed versions 0.13+ds1-60.13+ds2-1 |
None known |
swish-eUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1 |
None known |
tdomUbuntu:20.04:LTS |
All versions, plus listed versions 0.9.1-1 |
None known |
wbxml2Ubuntu:20.04:LTS |
All versions, plus listed versions 0.10.7-1build1 |
None known |
xmlrpc-cUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1 |
None known |
cadaverUbuntu:22.04:LTS |
All versions, plus listed versions 0.23.3-2.1build1 |
None known |
expatUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.1-22.4.1-32.4.2-12.4.3-12.4.3-2 Show 12 moreShow less2.4.4-12.4.6-12.4.7-12.4.7-1ubuntu0.12.4.7-1ubuntu0.22.4.7-1ubuntu0.32.4.7-1ubuntu0.42.4.7-1ubuntu0.52.4.7-1ubuntu0.62.4.7-1ubuntu0.72.4.7-1ubuntu0.82.4.7-1ubuntu0.9 |
None known |
insighttoolkit4Ubuntu:22.04:LTS |
All versions, plus listed versions 4.13.3withdata-dfsg1-4.14.13.3withdata-dfsg2-1ubuntu1 |
None known |
matanzaUbuntu:22.04:LTS |
All versions, plus listed versions 0.13+ds2-1 |
None known |
tdomUbuntu:22.04:LTS |
All versions, plus listed versions 0.9.2-1 |
None known |
wbxml2Ubuntu:22.04:LTS |
All versions, plus listed versions 0.10.7-1build10.11.7+dfsg-1 |
None known |
libxmltokUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.2-41.2-4ubuntu0.22.04.1~esm11.2-4ubuntu0.22.04.1~esm21.2-4ubuntu0.22.04.1~esm31.2-4ubuntu0.22.04.1~esm41.2-4ubuntu0.22.04.1~esm51.2-4ubuntu0.22.04.1~esm61.2-4ubuntu0.22.04.1~esm7 |
None known |
swish-eUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1 |
None known |
xmlrpc-cUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1 |
None known |
cadaverUbuntu:24.04:LTS |
All versions, plus listed versions 0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2 |
None known |
expatUbuntu:24.04:LTS |
All versions, plus listed versions 2.5.0-22.6.0-12.6.1-22.6.1-2build12.6.1-2ubuntu0.1 Show 5 moreShow less2.6.1-2ubuntu0.22.6.1-2ubuntu0.32.6.1-2ubuntu0.42.6.1-2ubuntu0.52.6.1-2ubuntu0.6 |
None known |
matanzaUbuntu:24.04:LTS |
All versions, plus listed versions 0.13+ds2-10.13+ds2-1build10.13+ds2-1build2 |
None known |
tdomUbuntu:24.04:LTS |
All versions, plus listed versions 0.9.3-10.9.3-1build1 |
None known |
wbxml2Ubuntu:24.04:LTS |
All versions, plus listed versions 0.11.8+dfsg-30.11.8+dfsg-3build1 |
None known |
libxmltokUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.2-4ubuntu11.2-4.1ubuntu11.2-4.1ubuntu21.2-4.1ubuntu2.24.0.4.1+esm11.2-4.1ubuntu2.24.0.4.1+esm21.2-4.1ubuntu2.24.0.4.1+esm31.2-4.1ubuntu2.24.0.4.1+esm41.2-4.1ubuntu2.24.0.4.1+esm5 |
None known |
swish-eUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1 |
None known |
xmlrpc-cUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1 |
None known |
cadaverUbuntu:26.10 |
All versions, plus listed versions 0.28+dfsg-2 |
None known |
expatUbuntu:26.10 |
All versions, plus listed versions 2.7.4-12.8.1-12.8.2-12.8.3-12.8.3-1ubuntu1 |
None known |
matanzaUbuntu:26.10 |
All versions, plus listed versions 0.13+ds2-2build1 |
None known |
swish-eUbuntu:26.10 |
All versions, plus listed versions 2.4.7-7.12.4.7-7.22.4.7-7.2build1 |
None known |
tdomUbuntu:26.10 |
All versions, plus listed versions 0.9.6-20.9.6-3 |
None known |
wbxml2Ubuntu:26.10 |
All versions, plus listed versions 0.11.10+dfsg-30.11.10+dfsg-4 |
None known |
xmlrpc-cUbuntu:26.10 |
All versions, plus listed versions 1.60.05-11.60.05-1build1 |
None known |
cadaverUbuntu:26.04:LTS |
All versions, plus listed versions 0.26+dfsg-20.28+dfsg-10.28+dfsg-2 |
None known |
expatUbuntu:26.04:LTS |
All versions, plus listed versions 2.7.1-22.7.3-12.7.4-12.7.4-1ubuntu0.12.7.4-1ubuntu0.2 |
None known |
matanzaUbuntu:26.04:LTS |
All versions, plus listed versions 0.13+ds2-20.13+ds2-2build1 |
None known |
tdomUbuntu:26.04:LTS |
All versions, plus listed versions 0.9.5.1-30.9.6-2 |
None known |
wbxml2Ubuntu:26.04:LTS |
All versions, plus listed versions 0.11.10+dfsg-20.11.10+dfsg-2build10.11.10+dfsg-3 |
None known |
xmlrpc-cUbuntu:26.04:LTS |
All versions, plus listed versions 1.59.03-10.11.60.05-1 |
None known |
swish-eUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1 |
None known |
expatopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.10.0-1.1 | 2.10.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| facts | OSV | |
| affected | EUVD, NVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118370 is a high vulnerability (CVSS 8.2) in Libexpat, published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in expat 2.10.0-r0.
References
github.com/libexpat/libexpat/pull/1450
vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-118370
security.alpinelinux.org/vuln/CVE-2026-118370
docs.bell-sw.com/security/cves/CVE-2026-118370
security-tracker.debian.org/tracker/CVE-2026-118370
ubuntu.com/security/CVE-2026-118370
cve.org/CVERecord?id=CVE-2026-118370
suse.com/security/cve/CVE-2026-113351