CVE-2026-56412: Use After Free
Last updated 21 September 2026
Other sources
libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.2-1 - Upgrade
Upgrade
debian/expatto a version that resolves this vulnerability.Fixed in 2.5.0-1+deb12u3Fixed in 2.8.3-1~deb13u1Fixed in 2.8.4-1Fixed in 2.8.4-2 - Upgrade
Upgrade
libexpatto a version that resolves this vulnerability.Fixed in 2.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56412?
The severity of CVE-2026-56412 is medium with a score of 4.9.
How does CVE-2026-56412 impact libexpat?
CVE-2026-56412 can lead to a use-after-free vulnerability due to lack of handler call depth tracking.
What versions of libexpat are affected by CVE-2026-56412?
libexpat versions before 2.8.2 are affected by CVE-2026-56412.
How can I mitigate CVE-2026-56412?
The recommended mitigation for CVE-2026-56412 is to update libexpat to version 2.8.2 or later.
Is CVE-2026-56412 related to any previous vulnerabilities?
Yes, CVE-2026-56412 is connected to an incomplete fix for CVE-2026-50219.