Out-of-bounds write in expat - CVE-2026-56132

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU144340

Out-of-bounds write in expat - CVE-2026-56132

Published: August 19, 2026


Vulnerability identifier: #VU144340
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56132
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause memory corruption.

The vulnerability exists due to an out-of-bounds write in doProlog when processing scaffolding index data. A remote attacker can supply crafted XML input to cause memory corruption.


Affected software

expat
Debian Linux
Anolis OS
Ubuntu
openEuler
Fedora
LANTIME Operating System Firmware (LTOS)
expat (Ubuntu package)
expat
expat-help
expat-devel
expat-debugsource
expat-debuginfo
expat-doc
expat-static
mingw-expat
expat (Debian package)

How to mitigate CVE-2026-56132

Install security update from vendor's website.

expat - update to 2.8.2
LANTIME Operating System Firmware (LTOS) - update to 7.10.013
expat (Ubuntu package) - addressed in versions 2.1.0-4ubuntu1.4+esm13, 2.1.0-7ubuntu0.16.04.5+esm14, 2.2.5-3ubuntu0.9+esm5, 2.2.9-1ubuntu0.8+esm3, 2.4.7-1ubuntu0.9, 2.6.1-2ubuntu0.6, 2.7.4-1ubuntu0.2
expat - addressed in versions 2.2.9-27, 2.4.1-26, 2.5.0-21
expat-help - addressed in versions 2.2.9-27, 2.4.1-26, 2.5.0-21
expat-devel - addressed in versions 2.2.9-27, 2.4.1-26, 2.5.0-21
expat-debugsource - addressed in versions 2.2.9-27, 2.4.1-26, 2.5.0-21
expat-debuginfo - addressed in versions 2.2.9-27, 2.4.1-26, 2.5.0-21
expat-devel - addressed in versions 2.5.0-2, 2.5.0-17
expat - addressed in versions 2.5.0-2, 2.5.0-17
expat-doc - update to 2.5.0-17
expat-static - update to 2.5.0-17
mingw-expat - addressed in versions 2.8.2-1.fc43, 2.8.2-1.fc44
expat (Debian package) - update to 2.8.2-1~deb13u1

External References

Related Security Bulletins