CVE-2026-76957: libexpat Use-After-Free Vulnerability

CVE-2026-76957 Overview

CVE-2026-76957 is a use-after-free vulnerability in libexpat before version 2.8.4. The library fails to track handler call depth when custom encoding callbacks are registered. An attacker who can supply crafted XML input processed with a custom encoding handler can trigger memory reuse after free, leading to memory corruption. The issue is closely related to CVE-2026-50219, CVE-2026-56131, and CVE-2026-56412, which addressed similar depth-tracking gaps in other Expat callback paths. Because libexpat is embedded in a wide range of language runtimes, XML parsers, and desktop applications, the flaw affects any software statically or dynamically linked against a vulnerable version.

Critical Impact
Local attackers supplying malicious XML to applications using custom encoding callbacks can trigger a use-after-free, resulting in memory corruption or process crash.

Affected Products

libexpat versions prior to 2.8.4
Applications and language runtimes bundling vulnerable libexpat (Python, Perl, PHP, and others when statically linked)
Operating system packages that ship libexpat as a shared library

Discovery Timeline

2026-08-20 - CVE-2026-76957 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76957

Vulnerability Analysis

The defect resides in libexpat's handling of user-supplied encoding callbacks. Expat allows applications to register a custom XML_UnknownEncodingHandler that maps unknown character encodings to conversion routines. When the parser recurses through nested XML constructs, it maintains a call depth counter to prevent unbounded recursion and to preserve object lifetimes across nested handler invocations. The custom encoding callback path did not participate in this depth tracking. As a result, a chunk of memory associated with a parser sub-object can be freed while a caller higher in the recursion still holds a reference to it, and that reference is subsequently dereferenced.

This is a classic use-after-free pattern [CWE-416]. The vulnerability follows the same class of issues previously fixed in related CVEs, indicating incomplete remediation of the underlying design gap in Expat's callback lifecycle model.

Root Cause

The root cause is missing handler call depth accounting in the code path that invokes custom encoding callbacks. Without this counter, Expat cannot reliably determine when it is safe to release intermediate parser state. Freed memory is later accessed when control returns up the recursive call chain.

Attack Vector

Exploitation requires local access and the ability to submit crafted XML to an application that registers a custom encoding handler. The attack complexity is high because it depends on triggering a specific nested parsing pattern in an application that uses this Expat feature. Successful exploitation can corrupt process memory, crash the parser, or, in some builds, be leveraged toward code execution.

No public proof-of-concept exploit is available at time of publication. See GitHub Pull Request #1322 and GitHub Pull Request #1329 for the upstream fix and technical discussion.

Detection Methods for CVE-2026-76957

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that parse XML using libexpat
Core dumps referencing Expat internal functions such as doContent, storeAtts, or unknown-encoding handler frames
AddressSanitizer or Valgrind reports flagging heap-use-after-free inside libexpat

Detection Strategies

Inventory installed libexpat versions across Linux, macOS, and Windows hosts and flag any build older than 2.8.4
Identify applications that register XML_SetUnknownEncodingHandler, as these are the exposed code paths
Correlate crash telemetry from XML-processing services with Expat stack frames to surface exploitation attempts

Monitoring Recommendations

Ingest process crash and Watson/coredump events into a centralized SIEM for correlation
Track package manager updates for expat, libexpat1, and language runtimes that vendor Expat
Alert on repeated parser crashes originating from the same user or workload

How to Mitigate CVE-2026-76957

Immediate Actions Required

Upgrade libexpat to version 2.8.4 or later on all affected systems
Rebuild and redeploy any application that statically links Expat after updating the library
Update language runtimes and packages that bundle Expat, including Python, Perl, and PHP distributions

Patch Information

The upstream fix adds handler call depth tracking to the custom encoding callback path. Review the changes in GitHub Pull Request #1322 and GitHub Pull Request #1329. Apply vendor packages once they ship 2.8.4 or backported fixes.

Workarounds

Remove or disable custom XML_UnknownEncodingHandler registrations where feasible
Restrict XML input to trusted sources until patched builds are deployed
Run XML parsing workloads under reduced privileges and memory-safe sandboxes to limit blast radius

bash

# Verify installed libexpat version on Debian/Ubuntu
dpkg -l | grep -i libexpat

# Verify installed libexpat version on RHEL/Fedora
rpm -q expat

# Upgrade on Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade libexpat1

# Upgrade on RHEL/Fedora
sudo dnf upgrade expat