CVE-2026-76957

MEDIUM4.9Memory safety

Description

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

CVSS breakdown

CVSS 3.1

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected products

libexpat project / libexpat0 – 2.8.4
libexpat project / libexpat2.8.4

References

PATCHhttps://github.com/libexpat/libexpat/pull/1322
PATCHhttps://github.com/libexpat/libexpat/pull/1329

Updated 45m ago · 8 sources