REDHAT-BUG-2484620: Use After Free

Q: What conditions are required to trigger the use-after-free?

The issue involves calls made from within XML handlers when a policy violation occurs. The affected calls are XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, and XML_ParserReset.

Q: Which versions are affected?

Versions of libexpat before 2.8.2 are affected.

Q: What should be prioritized for remediation?

Update libexpat to version 2.8.2 or later. Red Hat errata are referenced for remediation guidance and affected package updates.

Published Jun 4, 2026

Updated

libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

Affected Software

1 affected component

Expat libexpat<2.8.2

Event History

Jun 4, 2026

Data Sourced

via Red Hat·06:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required to trigger the use-after-free?

The issue involves calls made from within XML handlers when a policy violation occurs. The affected calls are XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, and XML_ParserReset.

Which versions are affected?

Versions of libexpat before 2.8.2 are affected.

What should be prioritized for remediation?

Update libexpat to version 2.8.2 or later. Red Hat errata are referenced for remediation guidance and affected package updates.

REDHAT-BUG-2484620: Use After Free

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the use-after-free?

Which versions are affected?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the use-after-free?

Which versions are affected?

What should be prioritized for remediation?