The libexpat XML parsing library before version 2.8.2 does not properly handle XML_TOK_DATA_CHARS tokens within the doCdataSection function. This results in missing handler call depth tracking for certain calls triggered by policy violations, which can cause a use-after-free condition. This vulnerability is a consequence of an incomplete fix for a previous issue identified as CVE-2026-50219. Exploitation could lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector.

Successful exploitation of this use-after-free vulnerability could allow an attacker with local access and high attack complexity to cause limited information disclosure, data modification, or denial of service. The CVSS vector indicates no privileges required and no user interaction, but the attack complexity is high and the attack vector is local, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor libexpat project advisories for updates and apply patches once released. Until then, avoid processing untrusted XML data with affected versions if possible.