expat: libexpat: Denial of Service due to incorrect Unicode surrogate handling

A flaw in libexpat's toUtf16 functions mishandles Unicode low surrogates by treating them as high surrogates. An attacker can exploit the resulting out-of-bounds read to trigger an infinite loop, causing a denial of service DoS...

expat: Fix of CVE-2026-56131

CVE-2026-56131: fix use-after-free caused by XMLResumeParser being callable from inside a handler, which re-enters the parser while the outer frame still owns bufferPtr/eventPtr...

CVE-2026-72522

A flaw in libexpat's toUtf16 functions mishandles Unicode low surrogates by treating them as high surrogates. An attacker can exploit the resulting out-of-bounds read to trigger an infinite loop, causing a denial of service DoS. Mitigation Limit exposure by restricting the parsing of untrusted or...

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

...

AZL-94698 CVE-2026-72522 affecting package expat for versions less than 2.8.3-1

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

UBUNTU-CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-72522

CVE-2026-72522 affects libexpat before 2.8.3, where an out-of-bounds read and infinite loop occur because low surrogates are treated the same as high surrogates in the *_toUtf16 functions. The vulnerability is an availability issue (HIGH impact) with local attack requirements and no confidentiali...

EUVD-2026-54990

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

CVE-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

Linux Distros Unpatched Vulnerability : CVE-2026-72522

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode...

PT-2026-69331

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.3 Description An out-of-bounds read and a resulting infinite loop occur during Unicode processing. This happens because low surrogates are treated identically to high surrogates within the toUtf16 functions...

CVE-2026-72522: Out-of-bounds Read

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the toUtf16 functions...

JLSEC-2026-1234

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId...

JLSEC-2026-1227

libexpat before 2.8.2 has an integer overflow in storeAtts...

JLSEC-2026-1223

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input...