← All advisories

Unrated severityNVD Advisory· Published Jun 21, 2026

CVE-2026-56409

CVE-2026-56409

Description

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9

Libexpat Project/Libexpatllm-fuzzy
Range: <2.8.2
osv-coords8 versions
pkg:apk/chainguard/expat pkg:apk/chainguard/expat-dev pkg:apk/chainguard/expat-doc pkg:apk/chainguard/libexpat1 pkg:apk/wolfi/expat pkg:apk/wolfi/expat-dev pkg:apk/wolfi/expat-doc pkg:apk/wolfi/libexpat1
< 2.8.2-r0+ 7 more
- (no CPE)range: < 2.8.2-r0
- (no CPE)range: < 2.8.2-r0
- (no CPE)range: < 2.8.2-r0
- (no CPE)range: < 2.8.2-r0
- (no CPE)range: < 2.8.2-r0
- (no CPE)range: < 2.8.2-r0
- (no CPE)range: < 2.8.2-r0
- (no CPE)range: < 2.8.2-r0

Patches

Vulnerability mechanics

References

1

github.com/libexpat/libexpat/pull/1259mitre

News mentions

1

Libexpat: Ten Integer Overflow and Use-After-Free Vulnerabilities Disclosed Together
Vypr Intelligence · Jun 21, 2026