EUVD-2026-63196

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: expat: expat-2.8.2-1.hum1 aarch64, x8664 expat-devel-2.8.2-1.hum1 aarch64, x8664 expat-static-2.8.2-1.hum1 aarch64, x8664 expat-2.8.2-1.hum1.src src Security Fixes: expat: CVE-2026-50219...

CVE-2026-50219 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-50219

libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,...

Linux Distros Unpatched Vulnerability : CVE-2026-50219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handle...