CVE-2026-56404 is an integer overflow vulnerability (CWE-190) in the libexpat project affecting versions before 2.8.2. The issue occurs in the addBinding function, where an integer overflow or wraparound can happen. This vulnerability has a CVSS 3.1 base score of 6.9 with attack vector local, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity, with low impact on availability. No patch or official remediation level has been disclosed yet.

Successful exploitation of this integer overflow could lead to unauthorized disclosure or modification of data (high confidentiality and integrity impact) and potentially limited disruption of service (low availability impact). However, exploitation requires local access and has high complexity, reducing the likelihood of widespread exploitation. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit local access to systems using vulnerable versions of libexpat and monitor for updates from the libexpat project regarding patches or mitigations.