CVE-2026-56412

Published: 6/21/2026 Last updated: 6/22/2026 Reserved: 6/21/2026

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

CNA assigner: mitre (8254265b-2729-46b6-b9e3-3dfca2d5bfca) Requested by: n/a

Metrics

Version	Score	Severity	Vector String
3.1	4.9	Medium	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Opam packages affected (4)

conf-expat conf-gtk2 conf-gtk3 ocaml-expat

Products affected (2)

Product	Vendor	Version
libexpat	libexpat project	< publication
libexpat	libexpat project	10 Version 1607 for x64-based Systems

References (2)

https://github.com/libexpat/libexpat/pull/1278
https://github.com/libexpat/libexpat/pull/1278