Vulnerability in libexpat Affects XML Handling in Software by Various Vendors

CVE-2026-56412

What is CVE-2026-56412?

The libexpat library prior to version 2.8.2 is vulnerable due to inadequate handling of XML tokens, specifically in the doCdataSection function. This vulnerability arises from a lack of proper depth tracking for handler calls, which can result in a use-after-free condition when certain XML policies are violated. The issue persists due to an incomplete mitigation of a previously identified vulnerability, indicating the importance of updating to the latest version to maintain robust security in applications utilizing this library.

References