CVE-2026-50219

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.2

Description The software lacks handler call depth tracking when specific functions are called from within handlers during a policy violation. This can lead to a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed. The affected functions are XML GetBuffer(), XML Parse(), XML ParseBuffer(), XML ParserFree(), and XML ParserReset().

Recommendations Update to version 2.8.2 or later.