CVE-2026-56132

Public on 2026-06-19
Modified on 2026-06-20
Description
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
8.1
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core expat Pending Fix
Amazon Linux 2023 expat Pending Fix
Amazon Linux 2 - Firefox Extra firefox Pending Fix
Amazon Linux 2023 firefox Pending Fix
Amazon Linux 2 - Core thunderbird Pending Fix
Amazon Linux 2023 xmlrpc-c Pending Fix

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-56132 Mitre: CVE-2026-56132