libexpat CVE-2026-56412

Exploitation requires all of the following: (1) the target application must use libexpat at a version prior to 2.8.2; (2) the application must register XML event handlers that are invoked during CDATA section parsing - applications that parse XML without custom handler callbacks are not affected in the same way; (3) a policy violation must be triggered during handler invocation while processing a XML_TOK_DATA_CHARS token inside a CDATA section, which is a non-default and specific XML structural condition. The high attack complexity (AC:H) reflects that reaching the use-after-free state requires this precise combination of handler configuration, XML structure, and policy-violation trigger. The local attack vector (AV:L per NVD) limits the formal attack surface to file-based or process-local XML parsing, though applications that accept XML documents from network sources extend the practical reach. Authentication is not required per the PR:N metric. Exploitation is meaningfully limited by the need for a handler-registration pattern that encounters a policy violation specifically within CDATA data-character processing, which is not a default parser state.

The NVD-assigned CVSS score of 4.9 with vector AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L reflects a moderate-to-low real-world risk profile with several important caveats. AV:L is conservative for a library vulnerability: libexpat routinely processes XML delivered over the network through higher-level applications, meaning network-exposed services effectively inherit a broader attack surface than AV:L implies - this is a notable discrepancy to verify in deployment context. AC:H correctly captures that exploitation requires a specific conjunction of handler registration, CDATA section processing, and a policy-violation scenario, which is not a default or trivially reached state. CIA impact is uniformly Low, consistent with a use-after-free that is difficult to control reliably for primitive exploitation. No EPSS score was included in the source intelligence, and no CISA KEV listing exists, meaning no confirmed active exploitation has been recorded. The absence of identified public proof-of-concept code further reduces immediate urgency. Despite the modest raw score, libexpat's ubiquity as a transitive dependency in broadly deployed software ecosystems makes broad patch adoption important to prevent silent accumulation of risk across downstream consumers.

An attacker crafts a malicious XML document containing a CDATA section that triggers a policy violation during event handler callback invocation within doCdataSection, specifically on a XML_TOK_DATA_CHARS token. When a libexpat-consuming application - such as a web API, messaging middleware, or content management platform - parses this document, the missing depth-tracking calls leave the parser's internal call-depth counter inconsistent, triggering a use-after-free. Depending on heap layout at the time of exploitation, the outcome may range from a crash and denial of service to limited memory disclosure; no public proof-of-concept code exists at time of analysis.