CVE-2026-50219 is a use-after-free vulnerability in the libexpat XML parsing library prior to version 2.8.2. The issue arises because the library does not track the call depth of handlers when functions such as XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset are invoked from within handlers in cases of policy violations. This lack of tracking can cause a use-after-free condition, potentially leading to memory corruption.

The vulnerability can result in use-after-free memory corruption, which may lead to information disclosure, integrity loss, or availability impact. The CVSS score of 4.9 indicates a medium severity impact with low attack vector (local), high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor libexpat project advisories for updates and consider avoiding calling the affected XML parsing functions from within handlers until a fix is available.