Skip to main content

libexpat CVE-2026-56412

| EUVDEUVD-2026-38189 MEDIUM
Use After Free (CWE-416)
2026-06-21 mitre GHSA-m2mm-5w64-p8p7
Information Disclosure Use After Free Memory Corruption Libexpat Red Hat Suse
5.9
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
5.9 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
5.6 MEDIUM

AV:N assigned because libexpat commonly parses XML delivered over the network via consuming applications; AC:H retained reflecting the specific policy-violation handler conditions required.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
4.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat
4.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
CVSS changed
Jun 23, 2026 - 15:53 NVD
4.9 (MEDIUM) 5.9 (MEDIUM)
Source Code Evidence Fetched
Jun 22, 2026 - 06:43 vuln.today
Analysis Generated
Jun 22, 2026 - 06:43 vuln.today
Patch available
Jun 21, 2026 - 18:01 EUVD

DescriptionNVD

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

AnalysisAI

Use-after-free in libexpat before 2.8.2 arises from the doCdataSection function omitting beforeHandler/afterHandler depth-tracking calls for XML_TOK_DATA_CHARS tokens during CDATA section parsing - an incomplete fix for the related CVE-2026-50219. When a policy violation occurs during handler callback invocation in this code path, the parser's internal call-depth counter becomes inconsistent, enabling a use-after-free condition. An attacker supplying specially crafted XML to any libexpat-consuming application may trigger limited memory corruption, information disclosure, or availability impact under high-complexity conditions; no public exploit is identified at time of analysis and no CISA KEV listing exists.

Technical ContextAI

libexpat (CPE: cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*) is a widely-embedded C XML parsing library used as a direct or transitive dependency across Python (pyexpat), PHP, D-Bus, and numerous other runtimes. The flaw (CWE-416: Use-After-Free) is located in the doCdataSection function within expat/lib/xmlparse.c. Internal wrappers beforeHandler() and afterHandler() maintain a call-depth counter that governs whether nested handler invocations are safe. The original CVE-2026-50219 fix added these guards to some handler invocation sites; this CVE documents that the XML_TOK_DATA_CHARS branch inside doCdataSection was missed. When that token type is encountered and a policy violation is raised, handlers are called without depth tracking, leaving the heap state inconsistent and creating a use-after-free window. The upstream fix (PR #1278) inserts matching beforeHandler/afterHandler calls in the omitted branches.

RemediationAI

Upgrade libexpat to version 2.8.2 or later, which introduces the missing beforeHandler(parser) and afterHandler(parser) depth-tracking calls in the XML_TOK_DATA_CHARS branch of doCdataSection. The upstream fix is tracked at https://github.com/libexpat/libexpat/pull/1278 and the fix version 2.8.2 is confirmed by EUVD-2026-38189. Note that the fix version is inferred from the upstream PR and EUVD data rather than a standalone dedicated security advisory - verify against the official libexpat release page. For environments unable to patch immediately, restrict XML inputs to trusted and validated sources only, preventing untrusted parties from supplying CDATA-containing XML to the parser (trade-off: limits functionality for legitimate use cases involving external XML feeds). Applications using Python's pyexpat, PHP, or other runtimes that bundle libexpat must update those runtime versions independently, as library-level patching of the embedded copy requires a runtime or vendor update rather than an OS-level patch.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected

Share

CVE-2026-56412 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy