Pypy3: PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that… (CVE-2026-76875)

CVE-2026-76875 describes a use-after-free vulnerability in PyPy's pyexpat module affecting versions prior to 3.11.16 and 3.12.14. The issue occurs in the ExternalEntityParserCreate function where external-entity sub-parsers are created without maintaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct. PyPy's tracing garbage collector may free the parent's C struct while the child parser still references it, causing bundled libexpat to dereference freed memory on each parsed token, resulting in memory corruption.

The vulnerability can lead to memory corruption in applications using the affected PyPy versions with the pyexpat module when parsing crafted XML documents that create external-entity sub-parsers without retaining parent references. This memory corruption could potentially be leveraged to cause application instability or other unintended behavior. The CVSS score is 5.3 (medium severity), indicating limited impact with no direct confidentiality or availability impact but with integrity impact.

A fix is available in PyPy versions 3.11.16 and 3.12.14. Users should upgrade to these or later versions to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patch.