CVE-2026-50219: Use After Free
libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50219?
The severity of CVE-2026-50219 is medium with a score of 4.9.
What is the main issue described in CVE-2026-50219?
CVE-2026-50219 describes a use-after-free vulnerability in libexpat before version 2.8.2 due to lack of handler call depth tracking.
How do I fix CVE-2026-50219?
To fix CVE-2026-50219, upgrade to libexpat version 2.8.2 or later.
What can exploit CVE-2026-50219?
CVE-2026-50219 can potentially be exploited in cases of policy violation during handler calls that attempt to access freed memory.
Which functions are affected by CVE-2026-50219?
CVE-2026-50219 affects functions including XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, and XML_ParserReset.