CVE-2026-118370

HighCVSS 8.2/10Last modified Nov 2, 2026

Description

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
libexpat	libexpat	<= 2.9.0

References

Timeline

Published: Oct 28, 2026
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1183713.7LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which wri CVE-2026-1183723.7LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF seq CVE-2026-1183733.7LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_al CVE-2026-1183745.9LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sendi CVE-2026-1183758.1llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows CVE-2026-1183765.3WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 address CVE-2026-1183777.5mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to for CVE-2026-1183787.8Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements b CVE-2026-118384.3Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Ind CVE-2026-11838310.0A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The c CVE-2026-1183846.1GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in vfat.c.CVE-2026-1183866.5Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were d