CVE-2026-72522
Received Received - Intake

XML Parsing DoS in Expat Library via Unicode Surrogate Handling

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: MITRE

Description
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72522
EUVD
EUVD-2026-54990

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libexpat libexpat to 2.8.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

libexpat before version 2.8.3 contains an out-of-bounds read flaw in the *_toUtf16 functions. This occurs because low and high Unicode surrogates are incorrectly treated the same during processing, leading to an infinite loop.

Detection Guidance

To detect this vulnerability, check the version of libexpat installed on your system. Run: 'expat --version' or 'dpkg -l | grep expat' on Debian-based systems. If the version is below 2.8.3, the system is vulnerable.

Impact Analysis

This vulnerability can cause applications using vulnerable libexpat versions to hang or crash due to the infinite loop. It may lead to denial-of-service conditions if exploited maliciously.

Compliance Impact

This vulnerability causes an out-of-bounds read and infinite loop in libexpat's Unicode processing, which could lead to denial-of-service conditions. While not directly impacting data confidentiality or integrity, such disruptions may affect system availability, potentially violating compliance requirements for uptime and reliability in standards like HIPAA or GDPR.

Mitigation Strategies

Immediately update libexpat to version 2.8.3 or later. If updating is not possible, apply the patch from the GitHub pull request (https://github.com/libexpat/libexpat/pull/1296) to fix the out-of-bounds read and infinite loop issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72522. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart