CVE-2026-56131
CVE-2026-56131
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVSS 4.9 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
libexpat
- Versions
- ≥ 0, < 2.8.2: Affected (semver)
Update to 2.8.2
expat Debian:12
- Versions
- 2.5.0-1
- 2.5.0-1+deb12u1
- 2.5.0-1+deb12u2
- Affected ranges
- ECOSYSTEM: < 2.5.0-1+deb12u3
Update to 2.5.0-1+deb12u3
expat Debian:13
- Versions
- 2.7.1-2
- 2.7.2-1
- 2.7.3-1
- 2.7.3-2
- 2.7.4-1
- 2.7.5-1
- 2.8.0-1
- 2.8.0-2
- 2.8.1-1
- Affected ranges
- ECOSYSTEM: < 2.8.2-1~deb13u1
Update to 2.8.2-1~deb13u1
expat Debian:14
- Versions
- 2.7.1-2
- 2.7.2-1
- 2.7.3-1
- 2.7.3-2
- 2.7.4-1
- 2.7.5-1
- 2.8.0-1
- 2.8.0-2
- 2.8.1-1
- 2.8.2-1~deb13u1
- Affected ranges
- ECOSYSTEM: < 2.8.2-1
Update to 2.8.2-1
coin3 Ubuntu:Pro:14.04:LTS
- Versions
- 3.1.4~abc9f50-3
- 3.1.4~abc9f50-4
- 3.1.4~abc9f50-4ubuntu2
- 3.1.4~abc9f50-4ubuntu2+esm1
- 3.1.4~abc9f50-4ubuntu2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
expat Ubuntu:Pro:14.04:LTS
- Versions
- 2.1.0-4
- 2.1.0-4ubuntu1
- 2.1.0-4ubuntu1.1
- 2.1.0-4ubuntu1.2
- 2.1.0-4ubuntu1.3
- 2.1.0-4ubuntu1.4
- 2.1.0-4ubuntu1.4+esm1
- 2.1.0-4ubuntu1.4+esm2
- 2.1.0-4ubuntu1.4+esm4
- 2.1.0-4ubuntu1.4+esm6
- 2.1.0-4ubuntu1.4+esm7
- 2.1.0-4ubuntu1.4+esm8
- 2.1.0-4ubuntu1.4+esm9
- 2.1.0-4ubuntu1.4+esm10
- 2.1.0-4ubuntu1.4+esm11
- 2.1.0-4ubuntu1.4+esm12
- Affected ranges
- ECOSYSTEM: < 2.1.0-4ubuntu1.4+esm13
Update to 2.1.0-4ubuntu1.4+esm13
vnc4 Ubuntu:Pro:14.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37ubuntu5
- 4.1.1+xorg4.3.0-37ubuntu5.0.1
- 4.1.1+xorg4.3.0-37ubuntu5.0.2
- 4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vtk Ubuntu:Pro:14.04:LTS
- Versions
- 5.8.0-14ubuntu1
- 5.8.0-14ubuntu3
- 5.8.0-14.1ubuntu2
- 5.8.0-14.1ubuntu3
- 5.8.0-14.1ubuntu3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:14.04:LTS
- Versions
- 1.16.33-3.2ubuntu3
- 1.33.06-0ubuntu1
- 1.33.06-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
expat Ubuntu:Pro:16.04:LTS
- Versions
- 2.1.0-7
- 2.1.0-7ubuntu0.16.04.1
- 2.1.0-7ubuntu0.16.04.2
- 2.1.0-7ubuntu0.16.04.3
- 2.1.0-7ubuntu0.16.04.4
- 2.1.0-7ubuntu0.16.04.5
- 2.1.0-7ubuntu0.16.04.5+esm2
- 2.1.0-7ubuntu0.16.04.5+esm5
- 2.1.0-7ubuntu0.16.04.5+esm6
- 2.1.0-7ubuntu0.16.04.5+esm7
- 2.1.0-7ubuntu0.16.04.5+esm8
- 2.1.0-7ubuntu0.16.04.5+esm9
- 2.1.0-7ubuntu0.16.04.5+esm10
- 2.1.0-7ubuntu0.16.04.5+esm11
- 2.1.0-7ubuntu0.16.04.5+esm12
- 2.1.0-7ubuntu0.16.04.5+esm13
- Affected ranges
- ECOSYSTEM: < 2.1.0-7ubuntu0.16.04.5+esm14
Update to 2.1.0-7ubuntu0.16.04.5+esm14
ayttm Ubuntu:Pro:16.04:LTS
- Versions
- 0.6.3-3build1
- 0.6.3-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cableswig Ubuntu:Pro:16.04:LTS
- Versions
- 0.1.0+git20150808-1
- 0.1.0+git20150808-2
- 0.1.0+git20150808-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cadaver Ubuntu:16.04:LTS
- Versions
- 0.23.3-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
coin3 Ubuntu:Pro:16.04:LTS
- Versions
- 3.1.4~abc9f50+dfsg1-1
- 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1
- 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
gdcm Ubuntu:16.04:LTS
- Versions
- 2.4.4-4
- 2.4.4-4build1
- 2.4.4-4ubuntu1
- 2.6.1-3
- 2.6.2-1
- 2.6.2-2
- 2.6.2-3
- 2.6.3-1
- 2.6.3-1ubuntu1
- 2.6.3-2ubuntu1
- 2.6.3-3ubuntu1
- 2.6.3-3ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
insighttoolkit4 Ubuntu:16.04:LTS
- Versions
- 4.8.1-1ubuntu3
- 4.8.1-1ubuntu4
- 4.8.2-3.1ubuntu1
- 4.9.0-3ubuntu2
- 4.9.0-4ubuntu1
- 4.9.0-4ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libxmltok Ubuntu:Pro:16.04:LTS
- Versions
- 1.2-3build3
- 1.2-3ubuntu0.1~esm1
- 1.2-3ubuntu0.16.04.1~esm1
- 1.2-3ubuntu0.16.04.1~esm2
- 1.2-3ubuntu0.16.04.1~esm3
- 1.2-3ubuntu0.16.04.1~esm4
- 1.2-3ubuntu0.16.04.1~esm5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
matanza Ubuntu:16.04:LTS
- Versions
- 0.13+ds1-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
smart Ubuntu:16.04:LTS
- Versions
- 1.4-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
swish-e Ubuntu:Pro:16.04:LTS
- Versions
- 2.4.7-4
- 2.4.7-4build1
- 2.4.7-4ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tdom Ubuntu:16.04:LTS
- Versions
- 0.8.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vnc4 Ubuntu:Pro:16.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37.3ubuntu2
- 4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vtk Ubuntu:Pro:16.04:LTS
- Versions
- 5.10.1+dfsg-2
- 5.10.1+dfsg-2build3
- 5.10.1+dfsg-2.1build1
- 5.10.1+dfsg-2.1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wbxml2 Ubuntu:16.04:LTS
- Versions
- 0.10.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published