CVE-2026-56412: Libexpat Use-After-Free Vulnerability

CVE-2026-56412 Overview

CVE-2026-56412 is a use-after-free vulnerability in libexpat versions before 2.8.2. The flaw exists in the doCdataSection function, which fails to consider XML_TOK_DATA_CHARS when tracking handler call depth during policy violation handling. An attacker who supplies a crafted XML document can trigger use-after-free memory corruption [CWE-416]. This issue exists because of an incomplete fix for CVE-2026-50219. Because libexpat is embedded in many language runtimes, browsers, and applications, exposure extends across a broad set of software ecosystems.

Critical Impact
Local attackers can trigger a use-after-free in libexpat by parsing malicious XML, leading to potential memory corruption that affects confidentiality, integrity, and availability of the host process.

Affected Products

libexpat versions prior to 2.8.2
Applications and language bindings that statically link or bundle vulnerable libexpat builds
Operating system distributions shipping libexpat packages before 2.8.2

Discovery Timeline

2026-06-21 - CVE-2026-56412 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56412

Vulnerability Analysis

The vulnerability resides in libexpat's CDATA section parser. The doCdataSection function does not account for the XML_TOK_DATA_CHARS token when enforcing handler call depth tracking. When user-registered handlers invoke parser routines during a policy violation, the parser can reach a state where memory referenced by the parser is freed while still being used. The result is a use-after-free condition classified under [CWE-416].

The original fix for CVE-2026-50219 introduced call depth tracking to prevent reentrancy issues. That fix was incomplete because it did not cover code paths reached via XML_TOK_DATA_CHARS. CVE-2026-56412 closes the remaining path.

Root Cause

The root cause is missing handler call depth bookkeeping for XML_TOK_DATA_CHARS processing inside doCdataSection. Handlers invoked during CDATA processing can recursively call into parser internals, triggering operations on memory that has already been released. The flaw is a logic gap in reentrancy protection rather than a direct memory management bug.

Attack Vector

Exploitation requires local access and the ability to deliver crafted XML input to an application that uses libexpat. No authentication or user interaction is required by the parser itself. An attacker provides an XML document containing a CDATA section structured to force reentrant handler invocation during a policy violation. The use-after-free corrupts heap state within the parsing process. Successful exploitation can yield information disclosure, integrity loss, or denial of service.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability mechanism is described in the upstream pull request; see the GitHub Pull Request for libexpat for the patch details.

Detection Methods for CVE-2026-56412

Indicators of Compromise

Crashes or abnormal terminations in processes that parse XML using libexpat, particularly during CDATA section handling
Heap corruption signatures reported by AddressSanitizer or system crash telemetry referencing doCdataSection
Unexpected child process termination in applications that consume untrusted XML inputs

Detection Strategies

Inventory installed libexpat versions across endpoints and servers and flag any version below 2.8.2
Use Software Composition Analysis (SCA) tooling to identify applications statically linking vulnerable libexpat builds
Monitor for XML payloads containing oversized or malformed CDATA sections delivered to XML-parsing services

Monitoring Recommendations

Collect process crash telemetry and correlate crashes in XML-parsing components with recent input received
Alert on repeated parser failures from the same source, which can indicate exploitation attempts
Track package manager events for libexpat updates to confirm patch deployment across the fleet

How to Mitigate CVE-2026-56412

Immediate Actions Required

Upgrade libexpat to version 2.8.2 or later on all affected systems
Rebuild and redeploy applications that statically link libexpat against the patched library
Restrict acceptance of XML input from untrusted local users where feasible until patching is complete

Patch Information

The fix extends handler call depth tracking to include XML_TOK_DATA_CHARS processing inside doCdataSection, completing the protection that was partially introduced for CVE-2026-50219. Apply distribution-provided updates for libexpat 2.8.2 or merge the upstream change documented in the GitHub Pull Request for libexpat.

Workarounds

Disable or constrain custom XML handlers in applications where they are not required
Reject XML documents containing unusually large or deeply nested CDATA sections at the application boundary
Run XML-parsing components under reduced privileges and process isolation to limit impact if exploitation occurs

bash

# Verify installed libexpat version on Linux
dpkg -l | grep -i libexpat        # Debian/Ubuntu
rpm -qa | grep -i expat           # RHEL/CentOS/Fedora

# Upgrade to the patched release
sudo apt-get update && sudo apt-get install --only-upgrade libexpat1
sudo dnf update expat