CVE-2026-56412
Fixed in a distro release EPSS <1%CVSS 4.9
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
Products: libexpat_project libexpat
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.21 | expat | 2.8.2-r0 |
| Alpine 3.22 | expat | 2.8.2-r0 |
| Alpine 3.23 | expat | 2.8.2-r0 |
| Alpine 3.24 | expat | 2.8.2-r0 |
| Amazon Linux 2 | thunderbird | 140.12.0-1.amzn2.0.1 |
| Amazon Linux 2023 | expat | 2.8.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | expat-devel | 2.8.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | expat-static | 2.8.3-1.amzn2023.0.1 |
| Amazon Linux 2023 | firefox | 140.12.0-1.amzn2023.0.1 |
| Chainguard | expat | 2.8.2-r0 |
| Chainguard | expat-dev | 2.8.2-r0 |
| Chainguard | expat-doc | 2.8.2-r0 |
| Chainguard | libexpat1 | 2.8.2-r0 |
| Debian 12 | expat | 2.5.0-1+deb12u3 |
| Debian 13 | expat | 2.8.2-1~deb13u1 |
| Debian 14 | expat | 2.8.2-1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.3 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.4 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Micro 5.5 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | expat | 2.8.5-150700.3.15.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | MozillaThunderbird | 153.5.0-150400.13.9.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | MozillaFirefox | 153.5.0-118.16.2 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | expat | 2.8.5-21.55.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server 16.0 | MozillaFirefox | 153.5.0-160000.1.1 |
| SUSE Linux Enterprise Server 16.0 | expat | 2.8.4-160000.1.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | MozillaFirefox | 153.5.0-118.16.2 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | expat | 2.8.5-21.55.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | 153.5.0-150400.157.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | expat | 2.8.5-150400.3.40.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | MozillaFirefox | 153.5.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | expat | 2.8.4-160000.1.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | MozillaThunderbird | 153.5.0-150400.13.9.1 |
| SUSE Linux Micro 6.2 | expat | 2.8.4-160000.1.1 |
| Ubuntu 16.04 LTS | cadaver | no fix |
| Ubuntu 16.04 LTS | gdcm | no fix |
| Ubuntu 16.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 16.04 LTS | matanza | no fix |
| Ubuntu 16.04 LTS | smart | no fix |
| Ubuntu 16.04 LTS | tdom | no fix |
| Ubuntu 16.04 LTS | wbxml2 | no fix |
| Ubuntu 18.04 LTS | cadaver | no fix |
| Ubuntu 18.04 LTS | gdcm | no fix |
| Ubuntu 18.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 18.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | smart | no fix |
| Ubuntu 18.04 LTS | tdom | no fix |
| Ubuntu 18.04 LTS | vnc4 | no fix |
| Ubuntu 18.04 LTS | wbxml2 | no fix |
| Ubuntu 20.04 LTS | cadaver | no fix |
| Ubuntu 20.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 20.04 LTS | matanza | no fix |
| Ubuntu 20.04 LTS | tdom | no fix |
| Ubuntu 20.04 LTS | wbxml2 | no fix |
| Ubuntu 22.04 LTS | cadaver | no fix |
| Ubuntu 22.04 LTS | expat | 2.4.7-1ubuntu0.8 |
| Ubuntu 22.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 22.04 LTS | libxmltok | no fix |
| Ubuntu 22.04 LTS | matanza | no fix |
| Ubuntu 22.04 LTS | tdom | no fix |
| Ubuntu 22.04 LTS | wbxml2 | no fix |
| Ubuntu 24.04 LTS | cadaver | no fix |
| Ubuntu 24.04 LTS | expat | 2.6.1-2ubuntu0.5 |
| Ubuntu 24.04 LTS | libxmltok | no fix |
| Ubuntu 24.04 LTS | matanza | no fix |
| Ubuntu 24.04 LTS | tdom | no fix |
| Ubuntu 24.04 LTS | wbxml2 | no fix |
| Ubuntu 25.10 | cadaver | no fix |
| Ubuntu 25.10 | expat | no fix |
| Ubuntu 25.10 | matanza | no fix |
| Ubuntu 25.10 | swish-e | no fix |
| Ubuntu 25.10 | tdom | no fix |
| Ubuntu 25.10 | wbxml2 | no fix |
| Ubuntu 25.10 | xmlrpc-c | no fix |
| Ubuntu 26.04 LTS | cadaver | no fix |
| Ubuntu 26.04 LTS | expat | 2.7.4-1ubuntu0.1 |
| Ubuntu 26.04 LTS | matanza | no fix |
| Ubuntu 26.04 LTS | tdom | no fix |
| Ubuntu 26.04 LTS | wbxml2 | no fix |
| Ubuntu 26.04 LTS | xmlrpc-c | no fix |
| Ubuntu 26.10 | cadaver | no fix |
| Ubuntu 26.10 | matanza | no fix |
| Ubuntu 26.10 | swish-e | no fix |
| Ubuntu 26.10 | tdom | no fix |
| Ubuntu 26.10 | wbxml2 | no fix |
| Ubuntu 26.10 | xmlrpc-c | no fix |
| Ubuntu Pro 14.04 LTS | coin3 | no fix |
| Ubuntu Pro 14.04 LTS | expat | 2.1.0-4ubuntu1.4+esm12 |
| Ubuntu Pro 14.04 LTS | vnc4 | no fix |
| Ubuntu Pro 14.04 LTS | vtk | no fix |
| Ubuntu Pro 14.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 16.04 LTS | ayttm | no fix |
| Ubuntu Pro 16.04 LTS | cableswig | no fix |
| Ubuntu Pro 16.04 LTS | coin3 | no fix |
| Ubuntu Pro 16.04 LTS | expat | 2.1.0-7ubuntu0.16.04.5+esm13 |
| Ubuntu Pro 16.04 LTS | libxmltok | no fix |
| Ubuntu Pro 16.04 LTS | swish-e | no fix |
| Ubuntu Pro 16.04 LTS | vnc4 | no fix |
| Ubuntu Pro 16.04 LTS | vtk | no fix |
| Ubuntu Pro 16.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 18.04 LTS | coin3 | no fix |
| Ubuntu Pro 18.04 LTS | expat | 2.2.5-3ubuntu0.9+esm4 |
| Ubuntu Pro 18.04 LTS | libxmltok | no fix |
| Ubuntu Pro 18.04 LTS | swish-e | no fix |
| Ubuntu Pro 18.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 20.04 LTS | expat | 2.2.9-1ubuntu0.8+esm2 |
| Ubuntu Pro 20.04 LTS | libxmltok | no fix |
| Ubuntu Pro 20.04 LTS | swish-e | no fix |
| Ubuntu Pro 20.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 22.04 LTS | swish-e | no fix |
| Ubuntu Pro 22.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 24.04 LTS | swish-e | no fix |
| Ubuntu Pro 24.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 26.04 LTS | swish-e | no fix |
| Wolfi | expat | 2.8.2-r0 |
| Wolfi | expat-dev | 2.8.2-r0 |
| Wolfi | expat-doc | 2.8.2-r0 |
| Wolfi | libexpat1 | 2.8.2-r0 |
| openSUSE Leap 16.0 | MozillaFirefox | 153.5.0-160000.1.1 |
| openSUSE Leap 16.0 | expat | 2.8.4-160000.1.1 |
| openSUSE Tumbleweed | expat | 2.8.2-1.1 |