CVE-2026-76957: Use After Free
Last updated 24 September 2026
Other sources
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/expatto a version that resolves this vulnerability.Fixed in 2.5.0-1+deb12u3Fixed in 2.8.4-1Fixed in 2.8.4-2 - Upgrade
Upgrade
libexpatto a version that resolves this vulnerability.Fixed in 2.8.4
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using libexpat versions before 2.8.4 are affected when custom encoding callbacks are in use. The issue is a use-after-free related to missing handler call depth tracking.
What access does an attacker need?
The supplied vector indicates local access is required, with high attack complexity. No privileges or user interaction are required.
How can I determine whether my environment is exposed?
Check the deployed libexpat version and whether the application uses custom encoding callbacks. Versions before 2.8.4 that use those callbacks should be treated as affected.
What should be done to remediate the issue?
Upgrade libexpat to version 2.8.4 or later. The provided data does not identify an alternative mitigation for environments that cannot upgrade immediately.