CVE-2026-56132 Memory corruption in libexpat

What is CVE-2026-56132?

CVE-2026-56132 is a medium-severity memory corruption vulnerability in Libexpat Project Libexpat, published on 19 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.

Weakness: CWE-821

Which versions are affected by CVE-2026-56132?

It affects 1 product.

Products include Libexpat Project Libexpat.

How do I fix CVE-2026-56132?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-56132 being exploited?

There is no known exploitation of CVE-2026-56132 in the wild and no public exploit code.

Other vulnerabilities in Libexpat Project Libexpat

• CVE-2024-45490 Integer overflow in n/a Critical 9.8
• CVE-2026-66046 Expat Denial of Service via storeAtts() Quadratic Complexity High 8.7
• CVE-2021-46143 Integer overflow in n/a High 8.1
• CVE-2017-11742 Privilege escalation in n/a High 7.8
• CVE-2025-59375 Denial of service in libexpat High 7.5

All Libexpat Project Libexpat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-56132, AZL-90243, BELL-CVE-2026-56132, DEBIAN-CVE-2026-56132, ECHO-a065-4d1e-ce4b, GHSA-425r-vwq2-26qv and 3 more.