CVE-2026-102633: libexpat Buffer Overflow Vulnerability

CVE-2026-102633 Overview

CVE-2026-102633 is an integer overflow vulnerability [CWE-190] in the expat_realloc() function of libexpat versions 2.7.2 through 2.8.5. The flaw affects 32-bit platforms when the library computes allocation sizes during XML parsing. Attackers who supply crafted XML content to applications using vulnerable libexpat can trigger heap buffer overflow, memory corruption, or denial of service. Because libexpat is embedded in thousands of applications, language runtimes, and operating system components, the impact surface is broad. The vulnerability was published to the National Vulnerability Database (NVD) on 2026-09-29.

Critical Impact
Remote attackers can trigger heap memory corruption or denial of service in any 32-bit application that parses attacker-controlled XML with libexpat 2.7.2 through 2.8.5.

Affected Products

libexpat 2.7.2 through 2.8.5 on 32-bit platforms
Applications and language bindings that embed vulnerable libexpat versions
Operating system distributions shipping libexpat 2.7.2–2.8.5

Discovery Timeline

2026-09-29 - CVE-2026-102633 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102633

Vulnerability Analysis

The vulnerability resides in expat_realloc() inside expat/lib/xmlparse.c. On 32-bit platforms, SIZE_MAX equals 2^32-1, making arithmetic on user-influenced sizes prone to wrap-around. The prior implementation relied on expat_heap_increase_tolerable() to enforce overflow bounds and only asserted that SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size. When a specially crafted XML document drives size beyond that limit, the assertion is bypassed in release builds and the subsequent realloc_fcn() call receives a truncated allocation size. The parser then writes past the shortened heap buffer, corrupting adjacent chunks.

Root Cause

The root cause is missing runtime validation of the requested allocation size before calling the underlying realloc function. The code trusted an upstream check that did not guarantee overflow safety across all code paths on 32-bit targets, leaving an integer overflow window between size computation and allocation.

Attack Vector

Exploitation requires an attacker to deliver malicious XML to any component that parses input through libexpat. Because parsing is network-reachable in web services, RPC endpoints, configuration loaders, and document processors, no authentication or user interaction is needed. The attack complexity is elevated because the target must run on a 32-bit build and the attacker must shape input to trigger the overflow condition.

     }
   }
 
-  // NOTE: Integer overflow detection has already been done for us
-  //       by expat_heap_increase_tolerable(..) above
-  assert(SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING >= size);
+  // Detect and prevent integer overflow
+  if (size > SIZE_MAX - sizeof(size_t) - EXPAT_MALLOC_PADDING) {
+    return NULL;
+  }
 
   // Actually allocate
   mallocedPtr = parser->m_mem.realloc_fcn(

Source: GitHub Commit 209801d. The patch replaces the release-stripped assert() with a runtime check that returns NULL when the requested size would overflow, preventing the truncated allocation.

Detection Methods for CVE-2026-102633

Indicators of Compromise

Unexpected crashes, segmentation faults, or aborts in 32-bit processes that invoke XML parsing routines backed by libexpat.
Heap corruption signatures reported by AddressSanitizer, glibc malloc checks, or Windows Application Verifier during XML processing.
Inbound XML payloads with unusually large attribute values, deeply nested elements, or oversized entity expansions targeting XML endpoints.

Detection Strategies

Inventory all binaries linking libexpat and identify installations at versions 2.7.2 through 2.8.5, focusing on 32-bit builds.
Deploy web application firewall (WAF) or API gateway rules to flag XML payloads exceeding expected size or nesting thresholds.
Correlate crash telemetry with process command lines that consume XML from untrusted sources.

Monitoring Recommendations

Enable and centralize crash dump collection for services processing XML, then alert on repeated faults in libexpat.so or libexpat.dll.
Monitor endpoint and server logs for repeated parser errors immediately preceding process termination.
Track outbound network activity from XML-processing services to identify possible post-exploitation callbacks.

How to Mitigate CVE-2026-102633

Immediate Actions Required

Upgrade libexpat to a fixed release that includes the expat_realloc() overflow check merged in pull request #1392.
Rebuild and redeploy statically linked applications, language runtimes, and container images that vendor libexpat.
Prioritize remediation on 32-bit systems, embedded devices, and legacy platforms where the overflow is reachable.

Patch Information

The fix is committed upstream in the libexpat repository. Reference the GitHub Commit 209801d, the underlying GitHub Pull Request #1392, and the VulnCheck Advisory for libexpat. Consult your operating system vendor for backported package updates.

Workarounds

Where feasible, run affected services on 64-bit platforms to eliminate the exploitable overflow window until patches are applied.
Enforce strict input validation and size limits on XML documents received from untrusted sources.
Disable or restrict XML parsing features that expand attacker-controlled content, such as external entities and large attribute values.

bash

# Verify installed libexpat version on Linux hosts
ldconfig -p | grep libexpat
strings /usr/lib/libexpat.so.1 | grep -i 'expat_'
dpkg -l | grep -i expat   # Debian/Ubuntu
rpm -qa | grep -i expat   # RHEL/Fedora