CVE-2026-76957: Use After Free
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using libexpat versions before 2.8.4 are affected when custom encoding callbacks are in use. The issue is a use-after-free related to missing handler call depth tracking.
What access does an attacker need?
The supplied vector indicates local access is required, with high attack complexity. No privileges or user interaction are required.
How can I determine whether my environment is exposed?
Check the deployed libexpat version and whether the application uses custom encoding callbacks. Versions before 2.8.4 that use those callbacks should be treated as affected.
What should be done to remediate the issue?
Upgrade libexpat to version 2.8.4 or later. The provided data does not identify an alternative mitigation for environments that cannot upgrade immediately.