EUVD-2026-88811
GHSA-4h3r-h8c5-46cf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted XML to PyPy app
-
DeliveryTrigger external-entity sub-parser creation
-
ExploitGC frees parent parser C struct
-
Executionlibexpat dereferences freed back-pointer
-
ImpactMemory corruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a PyPy application (not CPython - the bug depends specifically on PyPy's tracing garbage collector freeing the parent parser's C struct) that uses the pyexpat module's ExternalEntityParserCreate to create external-entity sub-parsers WITHOUT retaining a reference to the parent parser object. The application must also process attacker-supplied XML through this external-entity parsing path. This app-specific coding pattern is the AT:P attack requirement in the CVSS 4.0 vector and is the primary limiting factor: applications that keep a parent reference, disable external entity resolution, or run on CPython are not affected. Affected PyPy builds are those before the 3.11.16 / 3.12.14 fixes. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N) yields a 6.3 (Medium) score, and its shape is telling: the only impact recorded is integrity-low (VI:L), with no confidentiality and no availability impact, despite the flaw being a use-after-free that the description itself calls 'memory corruption.' The AT:P (attack requirement 'present') metric is the key signal - exploitation is not universal but depends on the target application following a specific coding pattern (creating external-entity sub-parsers without retaining a parent reference), which meaningfully narrows the real-world attack surface. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced, so this is not a widespread-exploitation priority. Weaponizing a GC-timing-dependent UAF into anything beyond a crash is non-trivial. Net: a legitimately-rooted memory-safety bug (patched, VulnCheck-reported) but currently low real-world risk - closer to a defense-in-depth patch than an emergency. Note a discrepancy: the description cites fixed versions 3.11.16 and 3.12.14, while the patch reference tags read 'release-pypy3.12-v8.0.0' / 'release-pypy3.11-v8.0.0' (PyPy's dual interpreter/release numbering) - reconcile the exact fixed build against the vendor release notes before remediating. |
| Exploit ScenarioDerived | An attacker submits a crafted XML document to a PyPy-based application that uses pyexpat's ExternalEntityParserCreate to spawn external-entity sub-parsers but does not retain a reference to the parent parser. PyPy's tracing garbage collector frees the parent parser's C struct while the child parser still holds a raw C back-pointer, so bundled libexpat dereferences the freed pointer on every parsed token, corrupting memory. No public proof-of-concept is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Memory corruption in PyPy's pyexpat module can be triggered by a crafted XML document processed through an external-entity sub-parser, because the child parser keeps a raw C back-pointer to a parent parser struct that PyPy's tracing garbage collector may free while the child is still in use, causing bundled libexpat to dereference freed memory on parsed tokens. Affected builds are PyPy releases prior to 3.11.16 and 3.12.14; the flaw is remotely reachable and unauthenticated (CVSS vectors carry PR:N), but exploitation depends on a specific application coding pattern - creating ExternalEntityParserCreate sub-parsers without retaining a reference to the parent parser - and on that code path processing attacker-supplied XML, which is the AT:P attack requirement in the CVSS 4.0 vector. That prerequisite is why the CVSS 4.0 score is 6.3 Medium with only integrity-low impact recorded, and no public exploit code or confirmed active exploitation was identified at time of analysis; vendor-released patches exist.
RemediationAI
Vendor-released patch: upgrade to PyPy 3.11.16 or later on the 3.11 line, or PyPy 3.12.14 or later on the 3.12 line, which correspond to the PyPy 3.11 v8.0.0 and PyPy 3.12 v8.0.0 release tags (https://github.com/pypy/pypy/releases/tag/release-pypy3.11-v8.0.0 and https://github.com/pypy/pypy/releases/tag/release-pypy3.12-v8.0.0; release notes at https://doc.pypy.org/release-v8.0.0.html). For deployments that cannot upgrade immediately, the primary compensating control is to keep a strong reference to the parent parser object for the entire lifetime of any sub-parser created with ExternalEntityParserCreate, which removes the garbage-collection race that leads to the free; the trade-off is a small amount of retained memory per parser and the need to audit every call site. A second, narrower mitigation is to disable external entity expansion in the parser configuration so the vulnerable sub-parser path is never reached (for example by leaving parameter-entity parsing at its safe default, refusing to install external entity handlers, or rejecting DTDs in untrusted documents); this costs support for legitimate external-entity or DTD-based XML workflows. Applications can also reduce exposure by parsing untrusted XML with a hardened library such as defusedxml or by moving the XML parsing workload to a patched CPython runtime, since the defect does not exist there; neither approach protects PyPy code that still reaches the vulnerable pyexpat path directly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is pyexpat, PyPy's C-level binding to the libexpat XML parser that ships with the interpreter. libexpat's ExternalEntityParserCreate() API spawns a subordinate parser inheriting configuration from a parent parser; in PyPy's binding, the child Python object stores a raw C pointer to the parent parser's C struct rather than a strong reference to the parent Python object. On CPython this is masked because reference counting keeps the parent alive as long as the child exists, but PyPy's tracing garbage collector has no reason to treat the C back-pointer as a liveness edge, so it can collect the parent object and free its C struct while the child sub-parser is still active. Because the child's handler callback consults the parent on essentially every token, libexpat then repeatedly dereferences the freed pointer, producing the use-after-free described by CWE-416 and the memory corruption (tagged also as buffer overflow) noted in the source tags. The CPE cpe:2.3:a:pypy:pypy:*:*:*:*:*:*:*:* confirms all PyPy builds are potentially in scope up to the fixed release lines (PyPy 3.11 before 3.11.16 and PyPy 3.12 before 3.12.14, shipped as the pypy3.11-v8.0.0 and pypy3.12-v8.0.0 releases); CPython is not affected because the defect is specific to PyPy's garbage collection and C-struct lifetime handling. Our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) treats exploitability as high-complexity for the same reason: the bug is only reachable in applications that use this exact external-entity sub-parser pattern on untrusted XML without holding a parent reference.
Know when Pypy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
AC:H because it needs a specific app pattern (no retained parent reference) plus GC timing; network-reachable via crafted XML with no auth; UAF gives limited integrity and likely crash (A:L), no confidentiality.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy's tracing garbage collector can free the parent's C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB