CVE-2026-56412 – Expat Use-After-Free Vulnerability

CVE ID :CVE-2026-56412

Published : June 21, 2026, 3:58 p.m. | 1 hour, 44 minutes ago

Description :libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

Severity: 4.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…