CVE-2026-56132Disclosure(libexpat_project / libexpat)

LOWCVSS 6.9 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch libexpat_project libexpat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.

libexpat_project CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/libexpat/libexpat/pull/1272

Weakness type (CWE)

CWE-821

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libexpat

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked at 2 mentions on most recent observed day (2026-10-23)
3 total mentions across 2 days

Affected systems

Vendors

libexpat_project

Products

libexpat

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

Patch

133.3%

Referenced assets1 URL

By indicator

https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56132

Classification over time

Date	Total	Labels

2026-06-19	1	Disclosure1
2026-10-23	2	Disclosure1Patch1

Full discourse3 posts

Siddhesh Bhurke@BhurkeSiddhesh9d
Patch
Side effect: hundreds of bugs found and patched, including a counter underflow in a decompressor, an out-of-bounds read in an image decoder, and a rediscovery of CVE-2026-56132 in libexpat.
Post summary
The text reports hundreds of bugs that were found and patched, including a rediscovery of CVE-2026-56132 in libexpat, with specific technical details about the vulnerability types but no mention of PoCs, exploits, or active exploitation.
1000017
354 followersView on X
AI Labs Wire@ailabswire10d
Disclosure
The proofs run on compiled RISC-V assembly, total ~180M lines of Rocq, built in weeks. Along the way Claude found bugs testing had missed, including CVE-2026-56132 in libexpat. Anthropic's caveat: proven property only, not "bug-free."
Post summary
The text briefly discloses CVE-2026-56132 in libexpat as a bug found during formal verification testing, with no PoC, exploit details, patch, or technical specifics provided.
0000021
34 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds136d
Disclosure
CVE-2026-56132 Heap-Based Buffer Overflow in libexpat Before 2.8.2 doProlog Function https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56132
Post summary
The post announces a newly disclosed heap‑based buffer overflow vulnerability in libexpat (versions before 2.8.2) affecting the doProlog function.
0000041
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libexpat_project	libexpat	-	-	-

Explore more

Back to dashboard libexpat_project CVEs libexpat vulnerabilities