Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: expat (UTSA-2026-142306)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142306 advisory. libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is similar to CVE-2026-50219,...

AlmaLinux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1789046411)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789046411 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.2:CLSA-2026:1789203877)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789203877 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is...

Rocky Linux 9.6 [TuxCare] Security Update: expat / expat-devel / expat-static (ALMALINUX9.6:CLSA-2026:1789046411)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789046411 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is...

CentOS Linux 8.4 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS8.4:CLSA-2026:1789142708)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789142708 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is...

CentOS Linux 8 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS-STREAM8:CLSA-2026:1789202718)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1789202718 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this i...

CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1789395602)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789395602 advisory. - libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after- free can occur. NOTE: this is simila...

CLSA-2026-1789046411 expat: Fix of CVE-2026-76957

CVE-2026-76957: protect custom encoding callbacks from parser reentry...

libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary...

libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary...

CVE-2026-76957

A flaw was found in libexpat. The library's handling of custom encoding callbacks lacks proper tracking of handler call depth, which can lead to a use-after-free vulnerability. This memory corruption flaw could allow a local attacker to cause a denial of service or potentially execute arbitrary...

SUSE CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the handler process when custom encoding callbacks are used without proper call depth tracking. An attacker can execute arbitrary code or cause unexpected behavior by triggering a use-after-free condition. Remediation...

ALPINE-CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

AZL-96851 CVE-2026-76957 affecting package expat for versions less than 2.8.3-2

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

UBUNTU-CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

EUVD-2026-63196

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...

CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412...