CVE-2026-56412

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

• CWE-416

• https://github.com/libexpat/libexpat/pull/1278Patch, Issue Tracking

Published

Jun 21, 2026

Last Modified

Jun 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56407libexpat before 2.8.2 has an integer overflow in doProlog th…6.9
• CVE-2026-56408libexpat before 2.8.2 has an integer overflow in copyString.6.9
• CVE-2026-56409xmlwf in libexpat before 2.8.2 has an integer overflow for t…6.5
• CVE-2026-5641A vulnerability was found in PHPGurukul Online Shopping Port…6.3
• CVE-2026-56410xmlwf in libexpat before 2.8.2 has an integer overflow in re…6.9
• CVE-2026-56411xmlwf in libexpat before 2.8.2 has an integer overflow in en…6.9
• CVE-2026-56413Storage Concentrator (SC & SCVM) contains a command injectio…10
• CVE-2026-56414A vulnerability exists in H.View IP cameras certificate-rela…8.6
• CVE-2026-56415Storage Concentrator (SC & SCVM) contains a command injectio…10
• CVE-2026-56416In NLnet Labs Unbound up to and including version 1.25.1, wh…4.8
• CVE-2026-5642A vulnerability was determined in Cyber-III Student-Manageme…7.3
• CVE-2026-56422Multiple MISP core controllers and model capture paths accep…9.4