Libexpat (< 2.8.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/libexpat--2.8.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 11 Aug 2026 12:01:55 +0000Denial of Service Vulnerability in libexpat Unicode Processinghttps://feed.craftedsignal.io/briefs/2026-08-libexpat-oob-read/Tue, 11 Aug 2026 12:01:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-libexpat-oob-read/An out-of-bounds read and infinite loop vulnerability in libexpat versions prior to 2.8.3, triggered by improper Unicode surrogate pair handling, allows for denial-of-service via malformed XML.CVE-2026-72522 identifies a critical flaw in the libexpat XML parsing library occurring in versions prior to 2.8.3. The vulnerability manifests during the processing of Unicode characters within the library's *_toUtf16 functions. Due to the failure to correctly distinguish between high and low surrogate pairs, the parser experiences an out-of-bounds read and enters an infinite loop when encountering malformed surrogate sequences in an input XML document. This behavior effectively leads to a denial-of-service (DoS) condition on any application utilizing the affected version of libexpat to process external or untrusted XML data. As libexpat is a widely used foundational component in many software ecosystems, the scope of potential impact is broad, depending on the exposure of the host application to unauthenticated XML input.

Impact

Successful exploitation of this vulnerability results in a denial-of-service condition, where the service or application processing the XML input becomes unresponsive due to the infinite loop. This can lead to service outages and resource exhaustion on affected systems. The vulnerability affects any software product that statically or dynamically links against libexpat versions earlier than 2.8.3.

Recommendation

Prioritize the identification of all applications and software stacks within the environment that include the libexpat library. Upgrade all instances of libexpat to version 2.8.3 or later to remediate CVE-2026-72522. For systems where an immediate library update is not feasible, restrict the ingestion of XML data from untrusted sources to minimize the risk of triggering the parsing flaw.

]]>lowadvisory