VDB
CVE-2026-76957
CVE-2026-76957
PUBLISHED
CVSS 4.9 MEDIUM
Reported by mitre · Published August 20, 2026
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
Risk Scores
CVSS 3.1
4.9
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| libexpat project | libexpat | 0 |
| libexpat_project | libexpat | 0 |
| alpine | expat | 0, 0, 0 |
| libexpat project | libexpat | 0 |
Timeline
- Aug 20, 2026 Coalition ESS Score
- Aug 20, 2026 CVE Published
- Aug 20, 2026 CVE Updated
- Aug 24, 2026 EPSS Score
- Sep 2, 2026 EPSS Score
- Sep 3, 2026 Security Advisory