CVE-2026-118370

A flaw was found in expat. An integer overflow in the XML attribute parsing logic allows a remote attacker to cause memory corruption and a Denial of Service (DoS). By supplying a specially crafted XML document containing an excessively large number of attributes, an attacker can trigger out-of-bounds memory writes, leading to an application crash.

This vulnerability is rated Moderate. A signed integer overflow in storeAtts() can lead to process crash; reliable confidentiality/integrity compromise is not demonstrated on Red Hat platforms. Red Hat scores CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9): Attack Complexity is High because triggering the overflow requires an extreme, multi-gigabyte XML payload with on the order of 2^30 attributes—typically blocked by practical network/memory limits before parse completes. NVD’s higher score (AC:L and I:L) is acknowledged; RH retains AC:H and I:N given payload prerequisites and platform allocator hardening (CME-117), while keeping A:H for crash/DoS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Reject oversized or attribute-dense untrusted XML before parsing; multi-gigabyte documents with huge attribute counts are required to hit the overflow. Apply process/cgroup memory limits to XML-handling workloads (CME-114 ↗, CME-704 ↗). Isolate XML-facing services and restrict to trusted sources (CME-202 ↗). Upgrade to libexpat 2.10.0 or later when available.