Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-56412 →

DEBIAN-CVE-2026-56412

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u3"}]}]

Debian:13 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1~deb13u1"}]}]

Debian:14 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1"}]}]

Références

advisory security-tracker.debian.org