libexpat CVE-2026-50219

Exploitation requires that an application built on libexpat (before 2.8.2) invokes one of five specific API functions - XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset - from within an active XML event handler callback (element handler, character data handler, entity reference handler, etc.) during a policy violation scenario. This re-entrant call pattern is the necessary and specific trigger; applications whose handlers do not call back into these libexpat lifecycle functions are not exploitable regardless of the XML input they process. The CVSS PR:N (no privileges required) means an unprivileged local user can supply the XML input, but the AC:H rating reflects that the re-entrant handler pattern must already exist in the target application code or its language binding. Language bindings (e.g., Python's xml.parsers.expat) that expose parser control to handler callbacks may extend this exposure to remote network contexts if they accept XML from untrusted sources. Exploitation is limited to versions of libexpat before 2.8.2; applications using libexpat as a shared library can be remediated by OS package upgrade without recompiling the application.

The CVSS 3.1 base score of 4.9 (Medium) reflects AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. The local attack vector (AV:L) and high attack complexity (AC:H) are significant mitigating factors: exploitation is not a simple network-to-RCE path but requires a specific re-entrant handler call pattern to be reachable. The impact vector (C:L/I:L/A:L) is consistent with a use-after-free that leaks or corrupts limited memory rather than guaranteeing full process takeover. No EPSS score was provided in available data, and the CVE is not listed in CISA KEV, indicating no confirmed widespread exploitation. However, the risk is meaningfully elevated by libexpat's pervasive embedding: it underlies Python's standard library XML modules, meaning a vulnerable pattern in a Python application could be triggered by attacker-supplied XML documents rather than requiring local binary access - creating a potential gap between the CVSS AV:L assessment and realistic deployment risk. CVSS indicates local vector but language bindings may expose this remotely via network-delivered XML - defenders should verify their specific binding's exposure. No POC exists at time of analysis, keeping real-world risk lower than the library's broad install base might otherwise suggest.

An attacker submits crafted XML to an application that uses libexpat (directly or via a Python/PHP/other binding) where the application's entity or character data handler calls XML_ParserFree or XML_Parse re-entrantly during parsing - a pattern sometimes seen in binding layers that allow handler-level parser lifecycle control. The re-entrant call frees or resets the still-active parser struct, creating a dangling pointer that is subsequently accessed during stack unwind, yielding a use-after-free that leaks heap memory contents or corrupts adjacent allocations. No public POC exists at time of analysis, and achieving reliable code execution would require additional heap-shaping steps given the high attack complexity rating.