# CVE-2026-56131: libexpat use-after-free in XML_ResumeParser

Source: https://junglewise.ai/threats/cve-2026-56131-libexpat-use-after-free-in-xml-resumeparser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56131 · Severity: medium · CVSS 4.9 · Published 2026-06-19

libexpat is a widely used library for processing XML data in various software applications. A flaw in how it handles paused data processing could allow an attacker to cause a system crash or potentially execute unauthorized code. This occurs when the library fails to properly track its internal state during complex data handling tasks, leading to memory corruption.

Technologies: [Libexpat Project Expat](https://junglewise.ai/threats/technologies/expat). Vendors: [Libexpat Project](https://junglewise.ai/threats/vendors/libexpat-project).

## Quick answers

**Is CVE-2026-56131 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56131 being exploited in the wild.

**How severe is CVE-2026-56131?** Medium severity, with a CVSS score of 4.9, published 19 June 2026.

**Which products and versions are affected?** Libexpat Project Expat before 2.8.2.

**Is there a fix for CVE-2026-56131?** A patch was published on 2026-06-20: Fix merged into master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56131 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-56131?** Check whether you run Libexpat Project Expat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in libexpat due to missing reentrancy guards in the XML_ResumeParser function. While other functions like XML_Parse and XML_GetBuffer were previously patched to track handler call depth, XML_ResumeParser was omitted. An attacker can exploit this by triggering a sequence where a handler suspends the parser and then immediately calls XML_ResumeParser, causing the parser to re-enter an active state while the outer parse is still on the stack. This leads to memory corruption and potential arbitrary code execution. The issue is addressed in version 2.8.2 by adding the isCalledFromInsideHandler check to XML_ResumeParser.

## Affected products

- libexpat project libexpat before 2.8.2

## Timeline

- 2026-06-06: other: Pull request submitted to libexpat repository
- 2026-06-19: disclosed: CVE published to NVD
- 2026-06-20: patched: Fix merged into master branch

## References

- [https://github.com/libexpat/libexpat/pull/1267](https://github.com/libexpat/libexpat/pull/1267)

## Related threats

- [libexpat use-after-free in doCdataSection](https://junglewise.ai/threats/cve-2026-56412-libexpat-use-after-free-in-docdatasection)
- [libexpat integer overflow in xmlwf endDoctypeDecl](https://junglewise.ai/threats/cve-2026-56411-libexpat-integer-overflow-in-xmlwf-enddoctypedecl)
- [libexpat xmlwf integer overflow in resolveSystemId](https://junglewise.ai/threats/cve-2026-56410-libexpat-xmlwf-integer-overflow-in-resolvesystemid)
- [libexpat xmlwf integer overflow in output filename handling](https://junglewise.ai/threats/cve-2026-56409-libexpat-xmlwf-integer-overflow-in-output-filename-handling)
- [libexpat integer overflow in copyString](https://junglewise.ai/threats/cve-2026-56408-libexpat-integer-overflow-in-copystring)