CVE-2026-56131

A use-after-free vulnerability in libexpat occurs because handler call depth isn't properly tracked when XML_ResumeParser is invoked during policy violations. This flaw can lead to information disclosure, data corruption, or denial of service.

A Moderate impact use-after-free vulnerability exists in libexpat. This flaw, requiring local access and having high attack complexity, could lead to information disclosure, data corruption, or denial of service. The need for specific policy violations and local access substantially reduces the immediate risk in typical Red Hat environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, avoid processing untrusted XML data in affected applications or ensure your implementation strictly validates and rejects malformed XML payloads before parsing.