Description

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-20T05:16:29.747Z",
  "pubdate": "2026-08-20T05:16:29.747Z",
  "executiveSummary": "A use-after-free vulnerability exists in libexpat prior to version 2.8.4, arising from the absence of handler call depth tracking when processing custom encoding callbacks. This memory corruption vulnerability poses severe security risks, potentially leading to arbitrary code execution, denial of service, or unauthorized memory disclosure depending on the heap layout and exploitation vector.\nThe flaw affects the libexpat XML parsing library across all systems integrating versions prior to 2.8.4. Similar to CVE-2026-50219, CVE-2026-56131, and CVE-2026-56412, the vulnerability manifests when handling specialized parsing instructions. An attacker capable of supplying a crafted XML input utilizing custom encoding callbacks can trigger improper memory management states.\nSuccessful exploitation requires the targeted application to parse untrusted XML data configured with custom encoding mechanisms. The risk implications are high, particularly in environments where libexpat processes external inputs without strict sandboxing. No explicit authentication or high-level privileges are inherently required, as the vulnerability can be triggered wherever the parser processes malicious input streams.",
  "technicalDetails": "The root cause of the vulnerability in libexpat prior to version 2.8.4 is the lack of handler call depth tracking when executing custom encoding callbacks during the XML parsing lifecycle. Without proper depth tracking, recursive or nested callback invocations can alter internal parser state and prematurely free underlying memory buffers while pointers to those structures remain active.\nThe vulnerable component resides within the encoding and handler execution subsystems of libexpat. When a custom encoding callback is registered and invoked, the lack of depth tracking permits re-entrant or nested modifications to parser structures. This leads to a dangling pointer scenario where subsequent operations attempt to access memory locations that have already been deallocated, resulting in a classic use-after-free condition.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious XML payload designed to invoke custom encoding callbacks in a specific sequence that stresses the unmonitored handler call depth. Second, the victim application ingests and parses this crafted input using libexpat. Third, during parsing, the nested or recursive callback execution triggers the premature release of dynamic memory buffers while internal references are still retained. Finally, subsequent memory operations dereference the dangling pointer, inducing a crash or facilitating arbitrary memory manipulation and potential code execution.\nAffected versions include all libexpat releases prior to 2.8.4. The vulnerability can be exploited locally or remotely depending on how the host application exposes the XML parsing interface to untrusted inputs. Authentication and privilege requirements depend entirely on the application architecture wrapping libexpat, though unauthenticated remote exploitation is feasible if exposed via network services."
}