Skip to main content

libexpat CVE-2026-76957

| EUVDEUVD-2026-63196 MEDIUM
Use After Free (CWE-416)
2026-08-20 mitre GHSA-vfgp-2986-rm7g
Use After Free Information Disclosure Memory Corruption Libexpat Suse
4.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
4.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
4.9 MEDIUM

AV:L and AC:H reflect the library-local exploitation context and dual prerequisite of custom encoding handler plus reentrant callback; PR:N applies because no authentication is needed to supply malicious XML input.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Patch available
Aug 20, 2026 - 05:01 EUVD
Source Code Evidence Fetched
Aug 20, 2026 - 05:00 vuln.today
Analysis Generated
Aug 20, 2026 - 05:00 vuln.today
CVE Published
Aug 20, 2026 - 04:28 cve.org
MEDIUM 4.9

DescriptionCVE.org

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

AnalysisAI

Use-after-free in libexpat before 2.8.4 allows an attacker who can supply crafted XML with a custom unknown-encoding declaration to corrupt parser memory when the encoding convert or release callback re-enters the parser without handler-depth tracking. Affected applications are those that register an UnknownEncodingHandler via XML_SetUnknownEncodingHandler - a non-default but legitimate usage pattern. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify application using XML_SetUnknownEncodingHandler
Delivery
Craft XML with attacker-controlled unknown encoding declaration
Exploit
Parser invokes custom encoding convert/release callback
Execution
Callback re-enters parser without depth tracking
Persist
Use-after-free corrupts parser heap state
Impact
Leak memory or crash parser process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application has registered a custom unknown-encoding handler using XML_SetUnknownEncodingHandler - this is not the default libexpat configuration and is needed only when parsing XML that may use encodings beyond the built-in set (ASCII, UTF-8, UTF-16, ISO-8859-1). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD CVSS base score of 4.9 with vector AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L correctly signals moderate, constrained risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker supplies a crafted XML document declaring an unknown custom encoding (e.g., encoding='attacker-enc') to an application that processes user-controlled XML and has registered a custom unknown-encoding handler. The encoding's release or convert callback is crafted to invoke a parser character handler re-entrantly; without the beforeHandler/afterHandler guard, the parser's depth-tracking invariant is violated, the encoding data pointer is freed while still referenced, and the attacker achieves a read or write to freed memory - potentially leaking heap contents or corrupting parser state. …
Remediation Upgrade libexpat to version 2.8.4 or later, which incorporates the handler-depth tracking fix for unknown-encoding callbacks as confirmed by PRs #1322 and #1329 (https://github.com/libexpat/libexpat/pull/1322, https://github.com/libexpat/libexpat/pull/1329). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse
CVE-2016-4472 HIGH
8.1 Jun 30

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attacke

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-76957 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy