CVE-2026-56131: Use After Free
libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56131?
The severity of CVE-2026-56131 is medium with a score of 4.9.
What type of vulnerability is CVE-2026-56131?
CVE-2026-56131 is classified as a Use After Free vulnerability.
How does CVE-2026-56131 affect the libexpat library?
CVE-2026-56131 affects libexpat by potentially allowing a use-after-free condition during handler calls, which can lead to data corruption.
How do I fix CVE-2026-56131?
To fix CVE-2026-56131, upgrade to libexpat version 2.8.2 or later, where the vulnerability is addressed.
What are the consequences of exploitation of CVE-2026-56131?
Exploitation of CVE-2026-56131 can lead to application crashes or arbitrary code execution due to the use-after-free condition.