CVE-2026-56403

A flaw was found in libexpat. An integer overflow vulnerability exists in the storeAtts function. This flaw could allow an attacker to corrupt memory, leading to a denial of service, information disclosure, or potentially arbitrary code execution, compromising the integrity and confidentiality of data.

A moderate-severity flaw was found in libexpat, which is provided by Red Hat Enterprise Linux (expat, compat-expat1, and mingw-expat), Red Hat In-Vehicle OS, and Red Hat JBoss Core Services, and is also bundled in container images shipped with products such as Red Hat OpenShift AI, Red Hat Ansible Automation Platform, and other Red Hat services offerings. An integer overflow in the storeAtts function during XML parsing allows a crafted XML document to trigger memory corruption, which can result in a denial of service, information disclosure, or potentially arbitrary code execution. Red Hat rates this flaw as Moderate (CVSS 3.1 score 6.9, AV:L/AC:H/PR:N/UI:N) because exploitation requires high attack complexity and an attacker must be able to supply a crafted XML document to an application that processes it with the affected library on the same system. Fixes for the affected Red Hat products are currently deferred: they will be delivered in a future planned update rather than an immediate security erratum, and the residual risk until then is limited to applications that parse attacker-controlled XML input using a vulnerable libexpat build. For Fedora, remediation is delegated to the Fedora community, which is pursuing a fix. This severity rating is consistent with the upstream assessment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has addressed this issue in libexpat 2.8.2, so updating affected systems to packages built from that version or a later one, once available, resolves the flaw.