CVE-2026-76957

Опубликовано: 20 авг. 2026

Источник: debian

EPSS Низкий

Описание

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Пакеты

Пакет	Статус	Версия исправления	Релиз	Тип
expat	unfixed			package
expat	no-dsa		trixie	package

Примечания

https://github.com/libexpat/libexpat/pull/1322

EPSS

Процентиль: 1%

0.00102

Низкий

Связанные уязвимости

CVE-2026-76957

CVSS3: 4.9

ubuntu

7 дней назад

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

CVE-2026-76957

CVSS3: 4.9

nvd

8 дней назад

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

CVE-2026-76957

msrc

6 дней назад

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

GHSA-vfgp-2986-rm7g

CVSS3: 4.9

github

8 дней назад

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

EPSS

Процентиль: 1%

0.00102

Низкий