Fluid Attacks Database

Description

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rpm rhel8	expat	<0:2.5.0-2.el8_10.2	0:2.5.0-2.el8_10.2
rpm rhel6	compat-expat1	-	-
rpm rhel6	expat	-	-
rpm rhel7	expat	-	-
debian 12	expat	=2.5.0-1 \|\| =2.5.0-1+deb12u1 \|\| =2.5.0-1+deb12u2 \|\| >=0 <2.5.0-1+deb12u3	2.5.0-1+deb12u3
rpm rhel10	expat	<0:2.7.3-1.el10_2.3	0:2.7.3-1.el10_2.3
rpm rhel9	expat	<0:2.5.0-6.el9_8.3	0:2.5.0-6.el9_8.3
debian 14	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| =2.8.2-1~deb13u1 \|\| >=0 <2.8.2-1	2.8.2-1
debian 13	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| >=0 <2.8.2-1~deb13u1	2.8.2-1~deb13u1
rpm rhel8	mingw-expat	-	-

1-10 of 14

Aliases

1. CVE-2026-502192. NVD-2026-502193. OSV-2026-502194. OSV-DEBIAN-2026-502195. OSV-ALPINE-2026-502196. SECURITY-TRACKER-CVE-2026-502197. SECURITY-CVE-2026-50219

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.