CVE-2026-72522

A flaw was found in libexpat. This vulnerability arises from incorrect handling of Unicode low surrogates, which are mistakenly treated as high surrogates during processing in the toUtf16 functions. This can lead to an out-of-bounds read and subsequently an infinite loop. A local attacker can...