CVE-2026-76957

Affected: libexpat project libexpat

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

USN-8813-1 — expat vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:18.04:LTS: expat, Ubuntu:Pro:20.04:LTS: expat, Ubuntu:22.04:LTS: expat, Ubuntu:24.04:LTS: expat, Ubuntu:26.04:LTS: expat

It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)

It was discovered that Expat did not correctly track handler call depth. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56131)

It was discovered that Expat did not correctly handle certain memory operations. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-56132)

It was discovered that Expat did not correctly handle certain Unicode characters. An attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-72522)

It was discovered that Expat did not correctly process certain XML attributes. A remote attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service. (CVE-2026-66046)

It was discovered that Expat did not correctly handle certain external entities. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76641)

It was discovered that Expat did not correctly track handler call depth with custom encodings. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code. (CVE-2026-76957)

Most recent entries from all

CVE-2026-76957

USN-8813-1 — expat vulnerabilities