libexpat 2.9.0 fixes two vulnerabilities

libexpat, one of the most widely used open-source XML parsing libraries, contains an integer overflow (CWE-190) in the expat_realloc() function when computing allocation sizes on 32-bit platforms, affecting versions 2.7.2 through 2.8.5. An attacker triggers the flaw by supplying maliciously crafted XML to any application that parses untrusted input with a vulnerable 32-bit build of the library, causing the size calculation to wrap around and resulting in an undersized heap allocation, heap buffer overflow, and memory corruption. The practical impact scored by CVSS 4.0 (8.2, high) is a severe availability impact — denial of service of the parsing process — via a network-reachable vector requiring no privileges or user interaction, though the attack requires high complexity and specific preconditions. Any software vendor or embedded device that statically links or ships a vulnerable 32-bit libexpat and parses attacker-controlled XML is affected, while 64-bit builds are not exposed to this specific flaw. No public proof-of-concept exists, the issue is not in CISA's Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported.

Do: Upgrade any libexpat 2.7.2–2.8.5 deployment to the first fixed release issued after 2.8.5 as soon as it ships from the libexpat project or your OS/package vendor. Audit embedded products, IoT firmware, and legacy applications that statically link libexpat on 32-bit architectures and that accept XML from network clients, since bundled copies will not update via system package managers. As interim mitigations, validate or limit the size of XML input before parsing and monitor parsing processes for crashes until patched builds are deployed.

libexpat before commit 13c5f63 has a heap buffer over-read (CWE-125) in xmlparse.c. XML_ParseBuffer advances parser->m_bufferEnd by a caller-supplied length that is not checked against the allocated buffer size, so repeated calls can move that pointer past the heap allocation and later parsing reads adjacent memory. The path requires a parse buffer to already exist, which happens after XML_GetBuffer or after an earlier XML_Parse that allocated the buffer; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. The over-read can disclose neighboring heap contents to the calling application, including heap, libc, and code pointers that weaken ASLR and can support further attacks, with high confidentiality impact and low availability impact. The issue is fixed in libexpat 2.9.0; it is not on the CISA KEV list and no public proof of concept is known.

Do: Upgrade libexpat to 2.9.0 or any build that includes commit 13c5f63, then rebuild or update applications that link against it. Until then, callers of XML_ParseBuffer should pass only a length that does not exceed the buffer obtained from XML_GetBuffer. No public proof of concept or confirmed in-the-wild exploitation is known.