RHSA-2026:40486MediumCVSS 6.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
July 15, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (3)

CVE-2026-56131 →CVE-2026-56404 →CVE-2026-56407 →

📋 Description

CVE-2026-56131 — libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking CVE-2026-56404 — libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding CVE-2026-56407 — libexpat: libexpat: Arbitrary code execution due to integer overflow

🎯 Affected products4

  • Red Hat Hardened Images
  • expat-main@aarch64 as a component of Red Hat Hardened Images
  • expat-main@src as a component of Red Hat Hardened Images
  • expat-main@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this vulnerability, avoid processing untrusted XML data in affected applications or ensure your implementation strictly validates and rejects malformed XML payloads before parsing. Workaround: Do not process untrusted or unvalidated XML with libexpat-based applications. Enforce strict maximum size limits on XML input and namespace URI lengths before parsing Workaround: To prevent exploitation explicitly disable all internal and external XML entity processing within your application's parser configuration. Additionally, use a Web Application Firewall (WAF) to strictly limit the maximum size of incoming XML payloads to prevent the overflow trigger.

🔗 References (7)