CVE-2026-50219
published 2026-06-04CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within…
PriorityP425medium5.9CVSS 3.1
AVLACLPRNUINSUCLILAL
EPSS
0.18%
7.3th percentile
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| debian | expat | — | — |
| debian | xmlrpc-c | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| libexpat_project | libexpat | < 2.8.4 | 2.8.4 |
| libexpat_project | libexpat | < 2.8.2 | 2.8.2 |
| libexpat_project | libexpat | < 2.8.4 | 2.8.4 |
| mozilla | firefox | — | — |
| mozilla | thunderbird | — | — |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| rhoai | odh-trustyai-garak-lls-provider-dsp-rhel9 | — | — |
| ubuntu | expat | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vendor_ubuntu7.5HIGH
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks.
ghsa_unreviewed·2026-08-20·CVSS 5.9
CVE-2026-76957 [MEDIUM] CWE-416 libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks.
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
GHSA
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation.
ghsa_unreviewed·2026-06-21·CVSS 5.9
CVE-2026-56412 [MEDIUM] CWE-416 libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation.
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
GHSA
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation.
ghsa_unreviewed·2026-06-19·CVSS 5.9
CVE-2026-56131 [MEDIUM] CWE-416 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation.
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
VulDB
libexpat up to 2.8.1 use after free (EUVD-2026-34206 / Nessus ID 318662)
vuldb·2026-06-05·CVSS 5.9
CVE-2026-50219 [MEDIUM] libexpat up to 2.8.1 use after free (EUVD-2026-34206 / Nessus ID 318662)
A vulnerability was found in libexpat up to 2.8.1. It has been rated as critical. Impacted is the function XML_GetBuffer/XML_Parse/XML_ParseBuffer/XML_ParserFree/XML_ParserReset. This manipulation causes use after free.
This vulnerability appears as CVE-2026-50219. The attack requires local access. There is no available exploit.
Upgrading the affected component is advised.
GHSA
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
ghsa_unreviewed·2026-06-04
CVE-2026-50219 [MEDIUM] CWE-416 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
Ubuntu
Expat vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 7.5
CVE-2026-50219 [HIGH] Expat vulnerabilities
Title: Expat vulnerabilities
Summary: Several security issues were fixed in Expat.
It was discovered that Expat could be made to allocate large amounts of
memory when parsing a small crafted document. An attacker could possibly
use this issue to cause Expat to consume resources, leading to a denial of
service. This issue was only addressed in Ubuntu 24.04 LTS.
(CVE-2025-59375)
It was discovered that Expat incorrectly handled empty external parameter
entity content. An attacker could possibly use this issue to cause Expat to
crash, resulting in a denial of service. (CVE-2026-32776)
It was discovered that Expat incorrectly handled certain DTD content. An
attacker could possibly use this issue to cause Expat to enter an infinite
loop, resulting in a denial of service. (CVE-2026-32777)
It
Red Hat
libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service
vendor_redhat·2026-08-20·CVSS 5.9
CVE-2026-76957 [MEDIUM] CWE-825 libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service
libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary code.
Statement: Red Hat ships libexpat (packaged as "expat") across many products. All versions of expat prior to 2.8.4 are affected by this use-after-free vulnerability. Exploitation requires trig
Red Hat
libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections
vendor_redhat·2026-06-21·CVSS 5.9
CVE-2026-56412 [MEDIUM] CWE-825 libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections
libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
A flaw was found in libexpat. This vulnerability, present in versions before 2.8.2, stems from improper handling of XML CDATA sections, where the library fails to adequately track the depth of handler calls. This can result in a 'use-after-free' error, a type of memory corruption that could allow an attacker to crash the application or potentially gain unauthorized control.
Package: exploit-intellige
Red Hat
libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking
vendor_redhat·2026-06-19·CVSS 5.9
CVE-2026-56131 [MEDIUM] CWE-416 libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking
libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XML_ResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service.
Statement: A Moderate impact use-after-free vulnerability exists in libexpat. This flaw, requiring local access and having high attack complexity, could lead to information disclosure, data corruption, or denial of service. The need for spec
Red Hat
expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking
vendor_redhat·2026-06-04·CVSS 5.9
CVE-2026-50219 [MEDIUM] CWE-911 expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking
expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition, which may result in information disclosure, integrity loss, or denial of service.
Package: expat (Red Hat Enterprise Linux 10) - Fix deferred
Package: compat-expat1 (Red Hat En
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-76957 expat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service [fedora-all]
bugzilla·2026-08-26·CVSS 5.9
CVE-2026-76957 [MEDIUM] CVE-2026-76957 expat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service [fedora-all]
CVE-2026-76957 expat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Bugzilla
CVE-2026-76957 mingw-expat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service [fedora-all]
bugzilla·2026-08-26·CVSS 5.9
CVE-2026-76957 [MEDIUM] CVE-2026-76957 mingw-expat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service [fedora-all]
CVE-2026-76957 mingw-expat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Bugzilla
CVE-2026-76957 libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service
bugzilla·2026-08-20·CVSS 5.9
CVE-2026-76957 [MEDIUM] CVE-2026-76957 libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service
CVE-2026-76957 libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Bugzilla
CVE-2026-56131 mingw-expat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking [fedora-all]
bugzilla·2026-07-31·CVSS 5.9
CVE-2026-56131 [MEDIUM] CVE-2026-56131 mingw-expat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking [fedora-all]
CVE-2026-56131 mingw-expat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
Bugzilla
CVE-2026-56131 expat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking [fedora-all]
bugzilla·2026-07-31·CVSS 5.9
CVE-2026-56131 [MEDIUM] CVE-2026-56131 expat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking [fedora-all]
CVE-2026-56131 expat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
Bugzilla
CVE-2026-56412 libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections
bugzilla·2026-06-21·CVSS 5.9
CVE-2026-56412 [MEDIUM] CVE-2026-56412 libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections
CVE-2026-56412 libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
Bugzilla
CVE-2026-56131 libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking
bugzilla·2026-06-19·CVSS 5.9
CVE-2026-56131 [MEDIUM] CVE-2026-56131 libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking
CVE-2026-56131 libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
Bugzilla
CVE-2026-50219 expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking [fedora-all]
bugzilla·2026-06-08·CVSS 5.9
CVE-2026-50219 [MEDIUM] CVE-2026-50219 expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking [fedora-all]
CVE-2026-50219 expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-50219 mingw-expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking [fedora-all]
bugzilla·2026-06-08·CVSS 5.9
CVE-2026-50219 [MEDIUM] CVE-2026-50219 mingw-expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking [fedora-all]
CVE-2026-50219 mingw-expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-50219 expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking
bugzilla·2026-06-04·CVSS 5.9
CVE-2026-50219 [MEDIUM] CVE-2026-50219 expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking
CVE-2026-50219 expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
2026-06-04
Published