CVE-2026-56412: Use After Free
libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.2-1 - Upgrade
Upgrade
libexpatto a version that resolves this vulnerability.Fixed in 2.8.2 - Compensating control
If you cannot upgrade past libexpat versions before 2.8.2 immediately, mitigate exploitation by limiting/isolating exposure of XML parsing workflows that could trigger policy-violation handling paths (e.g., restrict who can supply XML and isolate the parsing service).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56412?
The severity of CVE-2026-56412 is medium with a score of 4.9.
How does CVE-2026-56412 impact libexpat?
CVE-2026-56412 can lead to a use-after-free vulnerability due to lack of handler call depth tracking.
What versions of libexpat are affected by CVE-2026-56412?
libexpat versions before 2.8.2 are affected by CVE-2026-56412.
How can I mitigate CVE-2026-56412?
The recommended mitigation for CVE-2026-56412 is to update libexpat to version 2.8.2 or later.
Is CVE-2026-56412 related to any previous vulnerabilities?
Yes, CVE-2026-56412 is connected to an incomplete fix for CVE-2026-50219.