CVE-2026-72522

A flaw in libexpat's _toUtf16 functions mishandles Unicode low surrogates by treating them as high surrogates. An attacker can exploit the resulting out-of-bounds read to trigger an infinite loop, causing a denial of service (DoS).

A denial of service (DoS) flaw was found in libexpat's handling of Unicode surrogate pairs. An attacker providing specially crafted XML input to an application parsing untrusted data can trigger an out-of-bounds read and an infinite loop, leading to high CPU usage and system resource exhaustion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Limit exposure by restricting the parsing of untrusted or unverified XML inputs, and validate incoming XML documents for malformed character sequences before processing. Additionally, enforce process-level CPU resource limits and parsing timeouts to prevent system-wide Denial of Service from infinite parsing loops.