Multiple Use-after-free Vulnerabilities Found in Fedora's mingw-expat

Fedora has released advisories for multiple use-after-free vulnerabilities in the mingw-expat library affecting Fedora 43 and 44. CVE-2026-50219, published on 2026-06-04, involves improper handler call depth tracking, while CVE-2026-56412, published on 2026-06-21, pertains to improper handling of XML CDATA sections. Additionally, CVE-2026-56132, published on 2026-06-19, allows arbitrary code execution via a heap-based buffer overflow. These vulnerabilities could potentially lead to severe security risks if exploited. Users are advised to update their systems using the dnf upgrade command provided in the advisories. The vulnerabilities affect all Fedora users relying on the mingw-expat library, highlighting the importance of timely updates for security.

Key Points: • Fedora has issued advisories for critical vulnerabilities in the mingw-expat library. • CVE-2026-50219 and CVE-2026-56412 involve use-after-free vulnerabilities. • CVE-2026-56132 allows for arbitrary code execution via a buffer overflow.