CVE-2026-56404 is an integer overflow (CWE-190) vulnerability in the libexpat project affecting versions prior to 2.8.2. The issue occurs in the addBinding function, where an integer overflow or wraparound can happen. This vulnerability has a CVSS 3.1 base score of 6.9, with attack vector local, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity, and low impact on availability. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

Successful exploitation of this integer overflow could lead to unauthorized disclosure or modification of data (high confidentiality and integrity impact) and minor disruption of service (low availability impact). The local attack vector and high complexity reduce the likelihood of exploitation. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor libexpat project communications for updates. No specific mitigations are provided at this time.