CVE-2026-56411: Libexpat XXE Vulnerability via xmlwf

CVE-2026-56411 Overview

CVE-2026-56411 is an integer overflow vulnerability [CWE-190] in xmlwf, the command-line XML well-formedness checker bundled with the libexpat library. Versions of libexpat prior to 2.8.2 mishandle arithmetic in the endDoctypeDecl callback when processing NOTATION declarations within an XML document type definition (DTD). An attacker who can supply a crafted XML file to a local user running xmlwf can trigger memory corruption that affects confidentiality, integrity, and availability of the parsing process.

Critical Impact
A locally supplied malicious XML file processed by xmlwf can trigger an integer overflow in endDoctypeDecl, leading to memory corruption with high confidentiality and integrity impact.

Affected Products

libexpat versions prior to 2.8.2
The xmlwf utility shipped with vulnerable libexpat builds
Downstream operating system packages and applications redistributing pre-2.8.2libexpat

Discovery Timeline

2026-06-21 - CVE-2026-56411 published to the National Vulnerability Database
2026-06-23 - CVE-2026-56411 last modified in NVD

Technical Details for CVE-2026-56411

Vulnerability Analysis

The vulnerability lives inside the endDoctypeDecl handler invoked by xmlwf when a DTD section closes. When the parsed DTD contains NOTATION declarations, libexpat performs arithmetic on counters or sizes that can exceed the bounds of their integer type. The overflow produces an undersized value that is later used to drive memory operations against structures associated with the notation list.

Exploitation requires local access with the ability to feed a crafted XML document to xmlwf. The attack complexity is high because the input must be shaped to produce reliable overflow conditions. No privileges or user interaction beyond invoking the parser are required. Successful exploitation impacts confidentiality and integrity at high levels, while availability impact is lower.

Root Cause

The root cause is unchecked integer arithmetic when accounting for NOTATION declarations during DTD finalization. The libexpat maintainers addressed the defect through the pull request tracked at libexpat PR #1263, which introduces bounds checks before allocation and indexing operations tied to notation processing.

Attack Vector

The attack vector is local. An adversary must place a malicious XML file on the target system and induce a user or automation pipeline to process it with xmlwf. The vulnerability manifests when the DTD parser closes the doctype and iterates over NOTATION entries with attacker-controlled counts or lengths.

No verified public proof-of-concept exists for CVE-2026-56411. See the libexpat security pull request for the authoritative description of the affected code path and the corrective patch.

Detection Methods for CVE-2026-56411

Indicators of Compromise

Unexpected crashes, aborts, or sanitizer reports from processes invoking xmlwf or applications linked against pre-2.8.2libexpat.
XML files containing unusually large or repetitive <!NOTATION ...> declarations inside DTD blocks.
Core dumps referencing endDoctypeDecl or surrounding libexpat symbols in stack traces.

Detection Strategies

Inventory installed libexpat versions across hosts and flag any package below 2.8.2.
Scan source repositories, container images, and build artifacts for vendored copies of libexpat prior to 2.8.2.
Use software composition analysis tooling to identify applications statically linking the vulnerable library.

Monitoring Recommendations

Alert on process crashes for binaries that invoke xmlwf or load libexpat shared objects.
Monitor execution of xmlwf against XML files originating from untrusted sources or shared directories.
Forward parser crash telemetry and DTD-related error events to a centralized SIEM for correlation.

How to Mitigate CVE-2026-56411

Immediate Actions Required

Upgrade libexpat to version 2.8.2 or later on all systems and rebuild dependent applications.
Apply distribution-provided security updates that backport the fix from libexpat PR #1263.
Audit container base images, language runtimes, and bundled tools that ship their own copy of libexpat.

Patch Information

The upstream fix is delivered through libexpat pull request #1263 and is included in libexpat2.8.2. Linux distributions and operating system vendors that redistribute libexpat should be tracked for backported package updates.

Workarounds

Avoid running xmlwf against XML documents from untrusted sources until patched packages are deployed.
Restrict execution of xmlwf to dedicated, low-privilege accounts and sandboxed environments.
Strip or reject <!NOTATION ...> declarations at upload or ingestion boundaries when feasible.

bash

# Verify the installed libexpat version on Linux
xmlwf -v

# Debian/Ubuntu: upgrade the package
sudo apt update && sudo apt install --only-upgrade libexpat1 expat

# RHEL/Fedora: upgrade the package
sudo dnf upgrade expat