The libexpat XML parsing library prior to version 2.8.2 does not properly track handler call depth for XML_TOK_DATA_CHARS within the doCdataSection function. This incomplete tracking causes a use-after-free condition when handlers are invoked recursively or in complex policy violation cases. The vulnerability is a consequence of an incomplete remediation of CVE-2026-50219, leaving the library susceptible to memory corruption issues.

Successful exploitation could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). The use-after-free condition may cause crashes or potentially allow an attacker with local access to execute arbitrary code or cause denial of service. However, exploitation requires high attack complexity and local access, with no privileges or user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor libexpat project advisories for updates addressing this vulnerability.