Fluid Attacks Database

Description

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel10	firefox	-	-
rpm rhel10	expat	-	-
rpm rhel6	expat	-	-
rpm rhel8	expat	-	-
rpm rhel8	firefox	-	-
alpine v3.23	expat	>=0 <2.8.4-r0	2.8.4-r0
alpine v3.21	expat	>=0 <2.8.4-r0	2.8.4-r0
alpine v3.22	expat	>=0 <2.8.4-r0	2.8.4-r0
debian 12	expat	=2.5.0-1 \|\| =2.5.0-1+deb12u1 \|\| =2.5.0-1+deb12u2 \|\| >=0 <2.5.0-1+deb12u3	2.5.0-1+deb12u3
debian 13	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| =2.8.2-1 \|\| =2.8.2-1~deb13u1 \|\| =2.8.3-1 \|\| =2.8.3-1~deb13u1 \|\| =2.8.4-1 \|\| =2.8.4-2 \|\| =2.8.5-1 \|\| =2.8.5-2 \|\| >=0 <2.9.0-1~deb13u1	2.9.0-1~deb13u1

1-10 of 20

Aliases

1. CVE-2026-769572. NVD-2026-769573. OSV-2026-769574. OSV-ALPINE-2026-769575. OSV-DEBIAN-2026-769576. SECURITY-CVE-2026-769577. SECURITY-TRACKER-CVE-2026-76957

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.