CVE-2026-76957: CWE-416 Use After Free in libexpat project libexpat

The libexpat XML parsing library before version 2.8.4 does not track handler call depth properly when custom encoding callbacks are used. This deficiency can cause a use-after-free condition, where memory is accessed after it has been freed. This vulnerability is categorized under CWE-416 (Use After Free) and is similar to previously reported vulnerabilities CVE-2026-50219, CVE-2026-56131, and CVE-2026-56412. The CVSS v3.1 base score is 4.9, with attack vector local, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability rated as low.

Successful exploitation of this vulnerability could lead to unauthorized access to memory that has been freed, potentially causing application crashes or allowing limited information disclosure or integrity compromise. The impact is rated as low for confidentiality, integrity, and availability, reflecting limited but non-negligible risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users of libexpat should monitor vendor communications for updates and apply patches once available.