CVE-2026-102633

A flaw was found in expat. On 32-bit systems, an integer overflow occurs within the expat_realloc memory allocation function when calculating buffer sizes. A remote attacker can exploit this vulnerability by supplying specially crafted XML input to an application that processes data with the library. Successful exploitation can lead to a Denial of Service (DoS) or memory corruption.

A flaw of moderate impact was found in the expat XML parser library (libexpat), which is shipped in Red Hat Enterprise Linux and Fedora. On 32-bit systems, an integer overflow can occur in the expat_realloc() memory allocation function when buffer sizes are calculated, resulting in an undersized heap allocation that can lead to a heap buffer overflow, memory corruption, or a crash. A remote attacker can supply specially crafted XML input to an application that processes data with the vulnerable library, causing a denial of service of that application; no privileges or user interaction are required, but exploitation is limited to 32-bit platforms and requires triggering specific allocation sizes, so attack complexity is high.

Red Hat Product Security rates this flaw Moderate (CVSS 3.1 score 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVSS 4.0 rating of Important (8.2) because the vulnerability is restricted to 32-bit architectures with high attack complexity and its impact is limited to availability.

Affected expat and mingw-expat components span Red Hat Enterprise Linux 6 through 10, Red Hat In-Vehicle OS, Red Hat Hardened Images, and Fedora. For Red Hat Enterprise Linux and UBI-related streams, fixes are being pursued through delegated updates. For several maintenance streams the fix is deferred because the flaw is Moderate severity with a CVSS score below 7.0, leaving a residual risk of denial of service or memory corruption on 32-bit deployments until a fix is delivered. Red Hat Enterprise Linux 6 and certain platform streams are out of support scope and will not be fixed. The expat package in Red Hat Hardened Images (Hummingbird) is not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.