libexpat CVE-2026-76957

Exploitation requires three concurrent conditions: (1) the target application must use the XML_SetUnknownEncodingHandler API with application-supplied convert and/or release callbacks - default libexpat deployments without custom encoding handlers are not reachable; (2) the attacker must be able to supply attacker-controlled XML content to the parsing application, achievable either via local file placement or through any network-facing feature that passes user data to the vulnerable parser; (3) the attacker needs at least low-privilege local access (PR:L per CVSS AV:L) to deliver the malicious document. The flaw is not remotely exploitable in isolation; exploitation is limited to applications actively using the custom encoding handler extension point and accepting untrusted XML input.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic worst-case outcome - full process compromise - but the local attack vector sharply limits who can trigger it: an attacker must be able to supply a malicious XML file to an application that uses libexpat with a custom unknown encoding handler. EPSS 0.10% (1st percentile) and SSVC Exploitation:none confirm no observed in-the-wild use. Notably, the SSVC Technical Impact of 'partial' appears to understate the CVSS C:H/I:H/A:H; this discrepancy likely reflects SSVC accounting for real-world exploitation difficulty (local vector, requires custom encoding handler to be configured) rather than theoretical impact ceiling. The serial nature of related CVEs (CVE-2026-50219, CVE-2026-56131, CVE-2026-56412) indicates systematic reentrancy hardening is underway in the project; this pattern may attract researcher attention. Priority should be moderate: apply the patch in maintenance cycles, with urgency elevated for deployments where untrusted XML is parsed by privileged processes (e.g., daemons, setuid utilities).

An attacker with local access supplies a crafted XML document declaring a non-standard character encoding (e.g., 'reentrant-conv') to an application that invokes XML_SetUnknownEncodingHandler. When the parser encounters byte 0x80 routed through the custom convert callback, the callback re-enters the parser by invoking a character handler, corrupting the parser's internal encoding state and triggering use-after-free of heap-allocated parser structures, which the attacker leverages to redirect execution. No public proof-of-concept exploit has been identified at time of analysis, but the upstream test case in misc_tests.c demonstrates controlled triggering of the reentrancy condition.