CVE-2026-76957
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks.
Published Aug 20, 2026 · updated Oct 16, 2026
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Aug 20, 2026 · OSV.dev
Detected
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Oct 16, 2026 · OSV.dev
Fix available
expat fixed in 2.5.0-1+deb12u3; expat fixed in 2.9.0-1~deb13u1; expat fixed in 2.8.4-1
Oct 16, 2026 · OSV.dev
Fix available
expat fixed in 2.5.0-1+deb12u3
Oct 16, 2026 · OSV.dev
Fix available
expat fixed in 2.9.0-1~deb13u1
Oct 16, 2026 · OSV.dev
Fix available
expat fixed in 2.8.4-1
Oct 16, 2026 · OSV.dev
Updated
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Affected
- Debian:12 expat0 → 2.5.0-1+deb12u3
- Debian:13 expat0 → 2.9.0-1~deb13u1
- Debian:14 expat0 → 2.8.4-1