libexpat CVE-2026-56131

Exploitation requires two simultaneous conditions: (1) the target application links against libexpat before version 2.8.2, and (2) the application implements a handler callback (such as XML_SetCharacterDataHandler) that calls XML_StopParser with resumable=XML_TRUE followed immediately by XML_ResumeParser on the same parser object before the handler returns. Applications that do not call XML_ResumeParser from within handler callbacks are not affected by this vulnerability regardless of libexpat version. The local attack vector designation reflects that no remote attacker can independently satisfy condition (2) - only application code can invoke XML_ResumeParser; the attacker's role is limited to supplying XML content that triggers the vulnerable handler. Exploitation is further limited by AC:H: the specific handler re-entrancy pattern must already be present in the application, which is a non-default, atypical usage of the libexpat API.

The NVD-assigned CVSS 3.1 score of 4.9 with vector AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L reflects a constrained risk profile. The local attack vector (AV:L) captures the reality that while XML data can arrive over a network, the actual trigger - calling XML_ResumeParser from within a handler - is an application-code pattern; a remote attacker supplying only XML cannot force this re-entrant call unless the consuming application already implements such a handler. AC:H correctly reflects that the vulnerable re-entrancy pattern is non-default and application-specific. No KEV listing means active exploitation is not confirmed by CISA. No public POC beyond the test harness embedded in the fix PR is identified. EPSS data was not provided in source intelligence. The vulnerability is best prioritized for applications that process untrusted XML and whose handler code explicitly calls XML_ResumeParser within a callback - a relatively niche but real usage pattern seen in streaming XML processors. Applications not using this re-entrant pattern are unaffected regardless of libexpat version.

An attacker supplies crafted XML to an application that uses a vulnerable libexpat version and whose handler callback suspends and immediately resumes the parser from within the same handler invocation. When the character data (or similar) handler calls XML_StopParser followed by XML_ResumeParser on the active parser, libexpat re-enters the parse loop with a stale stack frame, producing a use-after-free condition that can leak heap memory contents or corrupt parser state. No public POC exploit exists at time of analysis, but the test code added in fix PR #1267 provides a clear reproduction template.