Medium severity4.9NVD Advisory· Published Aug 20, 2026· Updated Sep 8, 2026

CVE-2026-76957

Description

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Libexpat Project/Libexpatllm-fuzzy
Range: <2.8.4
osv-coords2 versions
pkg:rpm/opensuse/expat&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/expat&distro=openSUSE%20Tumbleweed
< 2.8.4-160000.1.1+ 1 more
- (no CPE)range: < 2.8.4-160000.1.1
- (no CPE)range: < 2.8.4-1.1

Patches

Vulnerability mechanics

References

github.com/libexpat/libexpat/pull/1322nvdIssue TrackingPatchVendor Advisory
github.com/libexpat/libexpat/pull/1329nvdIssue TrackingPatch

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000