CVE-2026-66046 libexpat project CVE debrief

Who should care

Defenders responsible for securing applications that parse untrusted XML, particularly those using Expat through version 2.8.3, should be aware of this vulnerability and take steps to mitigate it.

Why it matters

Defenders should prioritize verifying and updating Expat to a version that addresses this vulnerability, implementing monitoring to detect potential exploitation attempts, and ensuring that applications parsing untrusted XML are properly secured. This vulnerability can cause excessive CPU consumption, leading to a denial of service, and can be exploited by a remote unauthenticated attacker.

• Denial of service through excessive CPU consumption
• Potential for remote unauthenticated exploitation
• Need for verification and updating of Expat to a version that addresses this vulnerability

Technical summary

The storeAtts() function in xmlparse.c has a quadratic algorithmic complexity that can be triggered by processing N specified attributes with non-normalized values in an XML document. This can cause excessive CPU consumption, leading to a denial of service. The vulnerability can be exploited by a remote unauthenticated attacker supplying a single well-formed XML document of a few megabytes to an application parsing untrusted XML. Defenders should prioritize verifying and updating Expat to a version that addresses this vulnerability, implementing monitoring to detect potential exploitation attempts, and ensuring that applications parsing untrusted XML are properly secured.

Defensive priority

Defenders should prioritize verifying and updating Expat to a version that addresses this vulnerability, implementing monitoring to detect potential exploitation attempts, and ensuring that applications parsing untrusted XML are properly secured.

Recommended defensive actions

• Verify and update Expat to a version that addresses this vulnerability
• Implement monitoring to detect potential exploitation attempts
• Ensure that applications parsing untrusted XML are properly secured
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source-specific vulnerability assessments. The storeAtts() function in xmlparse.c has a quadratic algorithmic complexity that can be triggered by processing N specified attributes with non-normalized values in an XML document. This can cause excessive CPU consumption, leading to a denial of service. Defenders should verify and update Expat to a version that addresses this vulnerability, implement monitoring to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.