Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-76957 →

DEBIAN-CVE-2026-76957

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u3"}]}]

Debian:13 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1~deb13u1"}]}]

Debian:14 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-1"}]}]

Références

advisory security-tracker.debian.org