Skip to main content

libexpat EUVDEUVD-2026-37976

| CVE-2026-56131 MEDIUM
Use After Free (CWE-416)
2026-06-19 mitre GHSA-fchf-wvcc-qf9g
Information Disclosure Use After Free Memory Corruption Red Hat Libexpat Suse Libexpat Project
4.9
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
4.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI
5.6 MEDIUM

AV:N because XML triggering the handler arrives over network; AC:H retained as the re-entrant handler pattern is a non-default application prerequisite.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
4.5 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

3
Patch available
Jun 19, 2026 - 07:16 EUVD
Source Code Evidence Fetched
Jun 19, 2026 - 04:46 vuln.today
Analysis Generated
Jun 19, 2026 - 04:46 vuln.today

DescriptionCVE.org

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).

AnalysisAI

Use-after-free in libexpat before 2.8.2 allows memory corruption when XML_ResumeParser is called from within a handler callback during a policy-violation scenario. The missing call-depth guard permits re-entrant parser invocation, leaving dangling pointers in the parser's internal heap state and enabling potential information disclosure or memory corruption with low confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and the high attack complexity (AC:H) reflects the specific re-entrant handler pattern required to trigger the flaw.

Technical ContextAI

libexpat (Expat) is a widely-embedded C library for stream-oriented XML parsing, identified via CPE cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*. The vulnerability arises in the XML_ResumeParser function, which resumes a parser previously suspended via XML_StopParser. When an application's handler callback (e.g., a character data handler) suspends the parser and then immediately calls XML_ResumeParser on the same parser instance before the handler returns, libexpat lacked a guard to detect this re-entrant invocation. The fix in PR #1267 adds the check isCalledFromInsideHandler(parser) at the entry of XML_ResumeParser; without it, the parser re-enters its own parse loop while the prior handler frame is still on the call stack, corrupting internal state. The root cause class is CWE-416 (Use After Free), structurally identical to the prior CVE-2026-50219 issue, indicating a recurring class of re-entrancy defects in libexpat's handler dispatch subsystem.

RemediationAI

Upgrade libexpat to version 2.8.2 or later, which adds the isCalledFromInsideHandler guard to XML_ResumeParser (upstream fix: https://github.com/libexpat/libexpat/pull/1267). Note that the patched version 2.8.2 is stated in the CVE description but has not been independently confirmed as a released tagged artifact; verify availability via the libexpat GitHub repository before deployment. If upgrading is not immediately feasible, the most effective compensating control is to audit application code for handler callbacks that call XML_ResumeParser on the same parser instance and remove or restructure such patterns - this eliminates the re-entrancy trigger entirely. As an additional containment measure, run XML processing in sandboxed or isolated processes (e.g., seccomp-restricted worker processes) so that any use-after-free memory corruption cannot escalate beyond the parser process boundary. There are no known network-layer mitigations because the trigger is internal to application handler logic, not directly network-addressable.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

EUVD-2026-37976 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy