CVE-2026-76875

Name of the Vulnerable Software and Affected Versions PyPy versions prior to 3.11.16 PyPy versions prior to 3.12.14

Description A use-after-free issue exists in the pyexpat module's ExternalEntityParserCreate() function. This occurs when applications create external-entity sub-parsers without maintaining a reference to the parent parser. The child parser keeps a raw C back-pointer to the parent parser struct, but the tracing garbage collector may free the parent's C struct. Consequently, the bundled libexpat dereferences this freed pointer during token parsing, leading to memory corruption via a specially crafted XML document.

Recommendations Update to version 3.11.16 or later. Update to version 3.12.14 or later.