Executive Summary

This vulnerability exists in the libexpat library before version 2.8.2 and relates to improper handling of XML CDATA sections in the function doCdataSection. Specifically, the XML_TOK_DATA_CHARS handler was called without proper tracking of handler call depth, due to missing beforeHandler() and afterHandler() calls. This caused the internal handler call depth counter to remain at zero, leading the system to incorrectly believe it was not inside a handler when it actually was. Because of this, a previous fix (CVE-2026-50219) was bypassed, resulting in a use-after-free condition.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a use-after-free condition during XML parsing, which is a type of memory corruption. This can potentially be exploited to cause crashes, unexpected behavior, or even arbitrary code execution depending on the context in which libexpat is used. The CVSS score of 4.9 indicates a moderate severity with local attack vector, high attack complexity, and impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is related to the libexpat library's internal handling of XML CDATA sections and involves improper handler call depth tracking leading to a use-after-free condition.

Detection on a network or system level is not straightforward because this is a library-level issue affecting XML parsing behavior rather than a network-exposed service.

To detect if your system is vulnerable, you can check the version of libexpat installed. Versions before 2.8.2 are affected.

Suggested commands to check the installed libexpat version include:

• On Linux, run: `xmlwf --version` or `expat-config --version` if available.
• Alternatively, check the package manager: `dpkg -l | grep libexpat` (Debian/Ubuntu) or `rpm -q libexpat` (RedHat/CentOS).

For runtime detection of exploitation attempts, monitoring logs for crashes or unusual behavior in applications using libexpat might help, but no specific commands or signatures are provided.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade libexpat to version 2.8.2 or later, where the vulnerability has been fixed.

This update includes proper handler call depth tracking in the doCdataSection function, preventing the use-after-free condition.

If upgrading immediately is not possible, consider limiting or monitoring the use of XML parsing in your environment, especially for untrusted input.

Review and apply any patches or updates provided by your operating system or software vendors that include the fixed libexpat version.

Useful 0 Not Useful 0