CVE-2026-56131: libexpat Use-After-Free in XML_ResumeParser Handler Call Tracking

Technical summary

CVE-2026-56131 is a use-after-free condition (CWE-416) in libexpat arising from insufficient handler call depth tracking during XML_ResumeParser invocations. When a policy violation occurs and XML_ResumeParser is called from within a handler routine, the library does not correctly maintain the internal call stack counter. This allows a subsequent memory free operation to proceed while the freed memory region remains accessible via lingering references, creating a window for information disclosure or code execution depending on heap state and attacker control.

Business impact

Organizations deploying libexpat in XML parsing pipelines—common in configuration management, document processing, web services, and API gateways—face potential application instability and, in worst-case scenarios, privilege escalation or data exfiltration. The vulnerability is classified as MEDIUM severity, meaning impact is real but exploitation requires local access and specific handler conditions. For software vendors shipping libexpat as a dependency, this requires coordinated patching and customer notification.

Affected systems

libexpat versions prior to 2.8.2 are affected. Any application or library that bundles, links against, or depends on vulnerable versions of libexpat is in scope. This includes XML processors in configuration parsers, document handling systems, embedded devices, and containerized workloads. Verify your libexpat version and all downstream dependencies that may transitively pull in the library.

Exploitability

Exploitation is not trivial. The attack requires local execution context, specific timing around handler invocation and policy violation, and heap memory manipulation to convert use-after-free into a meaningful primitive. The CVSS score of 4.9 (MEDIUM) reflects this constraint: while local attackers with no special privileges can trigger the condition, successful weaponization demands sophistication. No public exploit code has been indexed in the CISA KEV catalog, indicating real-world exploitation has not yet become widespread.

Remediation

Upgrade libexpat to version 2.8.2 or later. Review your software bill of materials (SBOM) to identify all direct and transitive dependencies on libexpat. Test upgrades in a staging environment to ensure compatibility with your XML parsing workflows. For embedded systems or containerized deployments, rebuild and redeploy after patching the library.

Patch guidance

1. Obtain libexpat 2.8.2 or newer from the official project repository or your package manager. 2. Perform regression testing on XML parsing functionality with your organization's typical XML inputs and edge cases. 3. For vendored or embedded copies, manually update source trees and rebuild. 4. Prioritize patching in environments where libexpat processes untrusted XML (public APIs, user uploads, external data feeds). 5. Verify the patch by checking the library version string post-deployment.

Detection guidance

Monitor for libexpat versions in use via Software Composition Analysis (SCA) tools integrated into your CI/CD pipeline. Runtime detection is difficult without heap instrumentation; instead, focus on inventory and version scanning. Check application logs for XML parsing errors or crashes that might indicate exploitation attempts. In high-trust environments, memory sanitizers (AddressSanitizer, Valgrind) can help identify use-after-free conditions during testing.

Why prioritize this

Although marked MEDIUM severity, this vulnerability warrants prompt but not emergency patching because (a) it requires local access, (b) exploitation is non-trivial, and (c) it has not appeared in active exploitation databases. However, organizations processing untrusted XML, running multi-tenant systems, or hosting containerized workloads should prioritize this in the next regular patching cycle, as escaped containers or lateral movement scenarios could lower the bar for exploitation.

Risk score, explained

The CVSS v3.1 score of 4.9 reflects: Local attack vector (AV:L) — attacker must be on the target system; High attack complexity (AC:H) — specific conditions and timing are required; No privileges needed (PR:N); No user interaction (UI:N); Confidentiality, Integrity, and Availability each impacted at Low scope (C:L, I:L, A:L) — potential read of freed memory, potential code execution, potential denial of service, but not complete system compromise. This balances real risk with practical exploitation difficulty.

Frequently asked questions