CVE-2026-102633
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computi
CVSS
5.9
Medium
EPSS
0.3%
p27
KEV
—
Exploit Today
8
0-100
Published: Sep 29, 2026 · Last modified: Sep 29, 2026 · CWE-190
0.3%EPSS · 30 days0.3%
2026-09-302026-10-19
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
- github.comhttps://github.com/libexpat/libexpat
- github.comhttps://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003
- github.comhttps://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118
- github.comhttps://github.com/libexpat/libexpat/pull/1392
- www.vulncheck.comhttps://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-95107——
———A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that size and asked the object pool for the result **without checking the addition**. A size near the top of a `ULONG` wrapped, the pool served a block far smaller than the header, and the manager then wrote the header past the end of it and into the neighbouring byte-pool block.10hCVE-2026-1136815.5 MED—
———OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size calculation to zero, so UnPackPacked reads past a 4-byte buffer and crashes the application.10hCVE-2026-91189——
———The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are read verbatim from the file and only the upper bound of `last_glyph` is validated, so a page declaring `first_glyph > last_glyph` makes `last - first + 1` underflow to a very large unsigned count.
That count is multiplied by a glyph record size to reserve the load buffer, and the multiply is unchecked, so it wraps to a small value and the loader allocates a buffer far smaller than the data it is about to write. The load pass then recomputes the count in a narrower type and writes attacker-controlled glyph records into the undersized buffer.10hCVE-2026-43843——
——0An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.11hCVE-2026-101201——
——0A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-of-bounds read.10hCVE-2026-868715.9 MED—
——0An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination.15h