CVE-2026-76957
Received Received - Intake

Expat XML Parser Use-After-Free via Custom Encoding

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: MITRE

Description
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76957
EUVD
EUVD-2026-63196

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libexpat libexpat to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libexpat before 2.8.4 involves a lack of handler call depth tracking with custom encoding callbacks. This allows a use-after-free error to occur due to parser re-entry, where XML_Encoding.convert and XML_Encoding.release callbacks can be invoked recursively, leading to undefined behavior or crashes.

Detection Guidance

To detect this vulnerability, check the version of libexpat installed on your system. The vulnerability affects versions before 2.8.4. Use commands like 'expat --version' or 'dpkg -l | grep libexpat' on Debian-based systems or 'rpm -qa | grep expat' on RPM-based systems to verify the installed version.

Impact Analysis

The vulnerability may cause crashes or undefined behavior in applications using libexpat for XML parsing. Attackers could exploit this to execute arbitrary code or disrupt services, depending on the application's context and privileges.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a technical flaw in the libexpat library involving parser re-entry and custom encoding callbacks, which could lead to undefined behavior or crashes. No evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Update libexpat to version 2.8.4 or later to address the use-after-free vulnerability related to custom encoding callbacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart