← Back

CVE-2026-56131

nvd nist
Published: Jun 19, 2026Modified: Jun 23, 2026

JSON object

Loading...
4.9
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability: 1.4 / Impact: 3.4
Source: MITRE (Secondary)

Description

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).

Affected (1)

Libexpat Project
1 product
Libexpat
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Libexpat
Before 2.8.2

Related CWEs

CWE-416
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (1)

Source: cve@mitre.org
Patch

Timeline

No history available yet.