PT-2026-46147 · Libexpat+1 · Libexpat+1

Hartwork · CVE-2026-50219 · Published 2026-06-04 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.2

Description The software lacks handler call depth tracking when specific functions are called from within handlers during a policy violation. This can lead to a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed. The affected functions are XML GetBuffer(), XML Parse(), XML ParseBuffer(), XML ParserFree(), and XML ParserReset().

Recommendations Update to version 2.8.2 or later.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-50219

ECHO-D2DB-9152-3E07

OESA-2026-2680

RHSA-2026:30647

Affected Products

Ibm Aix

Libexpat

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50219.json · Exploit
• https://github.com/libexpat/libexpat/pull/1246 · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-50219 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-50219 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-50219 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-50219 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-50219 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-50219 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2680 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-50219 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-50219 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-50219 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-50219 · Security Note
• https://osv.dev/vulnerability/CVE-2026-50219 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-50219 · Vendor Advisory