Is CVE-2026-56412 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56412 being exploited in the wild.

How severe is CVE-2026-56412?

Medium severity, with a CVSS score of 4.9, published 21 June 2026.

Which products and versions are affected?

Libexpat Project Expat before 2.8.2.

Is there a fix for CVE-2026-56412?

A patch was published on 2026-06-20: Fix merged in GitHub pull request 1278 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56412 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-56412?

Check whether you run Libexpat Project Expat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56412: libexpat use-after-free in doCdataSection

CVE-2026-56412 · Severity: medium · CVSS 4.9 · Published 2026-06-21

libexpat is a widely used library for parsing XML data in various software applications. A flaw in how it handles specific XML data sections could allow an attacker to cause a program crash or potentially execute unauthorized code. This issue is particularly relevant for systems processing untrusted XML files, where it could lead to service instability or data corruption.

Technologies: Libexpat Project Expat. Vendors: Libexpat Project.

Quick answers

Is CVE-2026-56412 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56412 being exploited in the wild.
How severe is CVE-2026-56412?: Medium severity, with a CVSS score of 4.9, published 21 June 2026.
Which products and versions are affected?: Libexpat Project Expat before 2.8.2.
Is there a fix for CVE-2026-56412?: A patch was published on 2026-06-20: Fix merged in GitHub pull request 1278 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56412 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-56412?: Check whether you run Libexpat Project Expat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in libexpat before version 2.8.2 because the doCdataSection function fails to account for XML_TOK_DATA_CHARS when tracking handler call depth. This oversight allows the isCalledFromInsideHandler() check to be bypassed during the execution of handlers within a CDATA section, effectively nullifying previous security fixes (specifically CVE-2026-50219). An attacker can exploit this by providing specially crafted XML content that triggers a policy violation, leading to memory corruption. The vulnerability is reachable locally with high complexity and no prior authentication. The issue is addressed in version 2.8.2 by wrapping character data handler calls with proper before/after handler tracking.

Affected products

libexpat project libexpat before 2.8.2

Timeline

2026-06-20: patched: Fix merged in GitHub pull request 1278
2026-06-21: disclosed: CVE published to NVD

References

https://github.com/libexpat/libexpat/pull/1278

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.