Use-after-Free Vulnerability in libexpat Affects XML Parser Handler Calls

CVE-2026-56131

What is CVE-2026-56131?

The libexpat library, utilized for XML parsing, has a vulnerability that enables a use-after-free condition due to a lack of handler call depth tracking in specific circumstances. When a policy violation occurs, calls to XML_ResumeParser within user-defined handlers may compromise memory integrity, leading to potential arbitrary code execution. This issue mirrors the scenario described in a related vulnerability and emphasizes the importance of updating to libexpat version 2.8.2 or higher for security enhancements.

References