CVE-2026-76875 PyPy pyexpat ExternalEntityParserCreate Use-After-Free
Attackers can trigger memory corruption and potential code execution in PyPy applications by supplying crafted XML documents that exploit a use-after-free in the pyexpat module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76875?
CVE-2026-76875 is a medium-severity use after free vulnerability in PyPy, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy's tracing garbage collector can free the parent's C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.
Weakness: CWE-416
Which versions are affected by CVE-2026-76875?
How do I fix CVE-2026-76875?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-76875 being exploited?
There is no known exploitation of CVE-2026-76875 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-76875, GHSA-4h3r-h8c5-46cf, UBUNTU-CVE-2026-76875.