Log in Start free

Vulnerability · Published Jun 21, 2026 · Assigned by mitre

CVE-2026-56412

Medium 4.9

In plain English

A medium-severity use-after-free in libexpat from libexpat project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.2%top 92.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.21expat2.8.2-r0ALPINE-CVE-2026-56412
Alpine:v3.22expat2.8.2-r0ALPINE-CVE-2026-56412
Alpine:v3.23expat2.8.2-r0ALPINE-CVE-2026-56412
Alpine:v3.24expat2.8.2-r0ALPINE-CVE-2026-56412
Debian:12expat2.5.0-1+deb12u3DEBIAN-CVE-2026-56412
Debian:13expat2.8.2-1~deb13u1DEBIAN-CVE-2026-56412
Debian:14expat2.8.2-1DEBIAN-CVE-2026-56412
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-56412
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-56412
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-56412
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.8UBUNTU-CVE-2026-56412
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.8USN-8790-1
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.5UBUNTU-CVE-2026-56412
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.5USN-8790-1
Ubuntu:25.10expatno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.1UBUNTU-CVE-2026-56412
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.1USN-8790-1
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-56412
Ubuntu:22.04:LTSlibxmltokno fix listedUBUNTU-CVE-2026-56412
Ubuntu:24.04:LTSlibxmltokno fix listedUBUNTU-CVE-2026-56412
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-56412
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-56412
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-56412
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-56412
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-56412
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-56412
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-56412
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-56412
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-56412
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-56412
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-56412
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-56412

Affected products (as reported)

VendorProductVersions
libexpat project libexpat 0 – before 2.8.2

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References