Back Linuxsecurity

Fedora 44 mingw-expat Significant Use-after

Linuxsecurity •LinuxSecurity Advisories • July 6, 2026

[ 1 ] Bug #2486180 - CVE-2026-50219 mingw-expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking [fedora-all] [ 2 ] Bug #2493317 - CVE-2026-56412 mingw-expat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections [fedora-43] [ 3 ] Bug #2493319 - CVE-2026-56412 mingw-expat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections [fedora-44] [ 4 ] Bug #2493638 - CVE-2026-56132 mingw-expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-3cb1034453' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Use-after-free Vulnerabilities Found in Fedora's mingw-expat Fedora has released advisories for multiple use-after-free vulnerabilities in the mingw-expat library affecting Fedora 43 and 44. CVE-2026-50219, published on 2026-06-04, involves improper handler call depth tracking, while CVE-2026-56412, published on 2026-06-21, pertains to improper handling of XML CDATA sections. Additionally, CVE-2026-56132, published on 2026-06-19, allows arbitrary code execution via a heap-based buffer overflow. These vulnerabilities could potentially lead to severe security risks if exploited. Users are advised to update their systems using the dnf upgrade command provided in the advisories. The vulnerabilities affect all Fedora users relying on the mingw-expat library, highlighting the importance of timely updates for security. 2 sources 58

Extracted Entities

Fedora 44 mingw-expat Significant Use-after

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (3)

CWE Weaknesses (2)

Platforms (1)