CVE-2026-50219 is a vulnerability in libexpat where improper tracking of handler call depth during XML parsing can cause a use-after-free condition. This flaw affects libexpat versions before 2.8.2 and may result in information disclosure, integrity compromise, or denial of service. Red Hat Hardened Images RPMs including expat-2.8.2-1.hum1 for aarch64 and x86_64 architectures have been updated to fix this issue. The vulnerability is linked to CWE-911 (Improper Update of Reference Count) and CWE-131. Red Hat's advisory notes that no effective mitigation other than updating is available that meets their criteria for ease of use and stability.

The vulnerability can lead to use-after-free conditions causing potential information disclosure, integrity loss, or denial of service. The impact is rated medium by Red Hat, with low confidentiality, integrity, and availability impacts according to their CVSS assessment. There are no known exploits in the wild at this time.

Red Hat has released updated RPM packages (expat-2.8.2-1.hum1) for Red Hat Hardened Images to address this vulnerability. Applying these updates is the recommended remediation. No other mitigations meeting Red Hat's criteria are currently available. Users should apply the update as soon as possible to remediate the issue.