Executive brief
libexpat is an XML parsing library used in many applications to process XML data. A flaw in how the library handles custom character encoding callbacks can allow malicious XML input to trigger a use-after-free memory error, potentially leading to crashes or code execution. Applications using custom encoding callbacks are at risk when processing untrusted XML documents.
Technical details
The vulnerability is a use-after-free condition in libexpat's custom encoding callback handling, caused by insufficient handler call depth tracking when custom XML_Encoding.convert and XML_Encoding.release callbacks are invoked. The root cause is that these application-provided callbacks were not subject to the same parser re-entrancy protections that guard other handler callbacks, allowing a malicious XML document to trigger nested parser calls that free memory while it is still in use. An attacker must provide specially crafted XML to an application that implements custom encoding callbacks; no authentication is required and the attack is network-accessible. The fix, released in libexpat 2.8.4, wraps the custom encoding callbacks with Expat's existing handler reentrancy counter to enforce the same re-entry rejection rules applied to other callbacks.
Affected products
- libexpat expat before 2.8.4
Timeline
- 2026-08-20: disclosed
- 2026-08-31: patched: libexpat 2.8.4 released