JLSEC-2026-1236

libexpat before 2.8.2 does not consider XMLTOKDATACHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219...

CVE-2026-50219 vulnerabilities

Vulnerabilities for packages: expat...

CVE-2026-50219

creationtimestamp| type| source ---|---|--- 2026-06-04 06:41:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mngzdwoihc2c 2026-06-26 00:01:43+00:00| seen| https://bsky.app/profile/slackers.it/post/3mp5nc7dq3r2x...