CVE-2026-66046: libexpat_project libexpat Inefficient Algorithmic Complexity

Vulnerability summary

CVE-2026-66046 is a high (CVSS 8.7) Inefficient Algorithmic Complexity vulnerability in libexpat_project libexpat. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 18-08-2026
   PublishedVulnerability first disclosed.
2. 01-10-2026
   Last modifiedVulnerability information updated.

Description

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

• CWE-407Inefficient Algorithmic ComplexityAn algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.