Vulnerability · Published Sep 29, 2026 · Assigned by VulnCheck
CVE-2026-76875PyPy pyexpat ExternalEntityParserCreate Use-After-Free
Medium 5.3
In plain English
A medium-severity use-after-free in PyPy from PyPy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy's tracing garbage collector can free the parent's C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | pypy3 | no fix listed | DEBIAN-CVE-2026-76875 |
| Debian:13 | pypy3 | no fix listed | DEBIAN-CVE-2026-76875 |
| Debian:14 | pypy3 | 8.0.0+dfsg-1 | DEBIAN-CVE-2026-76875 |
| Ubuntu:22.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-76875 |
| Ubuntu:24.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-76875 |
| Ubuntu:26.04:LTS | pypy3 | no fix listed | UBUNTU-CVE-2026-76875 |
| Ubuntu:26.10 | pypy3 | no fix listed | UBUNTU-CVE-2026-76875 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- Release Notes release-notes
- 3.12 Release Tag patch
- 3.11 Release Tag patch
- https://www.vulncheck.com/advisories/pypy-pyexpat-externalentityparsercreate-use-after-free third-party-advisory