Executive Summary

A medium-severity vulnerability (CVE-2026-72522) in libexpat before version 2.8.3 can lead to a denial-of-service (DoS) attack due to an out-of-bounds read and infinite loop during Unicode processing. This vulnerability has a CVSS score of 6.2 and is not currently being actively exploited. Affected products include libexpat versions prior to 2.8.3.

Technical Analysis

CVE-2026-72522 is a vulnerability in the libexpat library, specifically in the *_toUtf16 functions used for Unicode processing. The vulnerability class is an out-of-bounds read, which results in an infinite loop when low surrogates are treated the same as high surrogates. The attack vector is local, meaning an attacker would need to have local access to the system to exploit this vulnerability.

How It Gets Exploited

An attacker with local access to a system using a vulnerable version of libexpat (prior to 2.8.3) could exploit this vulnerability by providing a specially crafted input that triggers the out-of-bounds read and infinite loop in the *_toUtf16 functions. This could potentially lead to a denial-of-service (DoS) condition, causing the system to become unresponsive or crash. The attacker would need to have a local presence on the system, either through a user account or by exploiting another vulnerability to gain local access.

Impact Assessment

The impact of CVE-2026-72522 is primarily on the availability of the system, with a CVSS score of 6.2 indicating a medium severity. Successful exploitation could lead to a denial-of-service (DoS) condition, affecting the system's availability. The confidentiality and integrity impacts are none, according to the CVSS metrics.

Recommended Actions

To mitigate this vulnerability, it is recommended to update libexpat to version 2.8.3 or later. This can be done by applying the latest patches or updates provided by the libexpat project or the distribution maintainers. No workarounds are available, but ensuring that systems are up to date with the latest software versions can prevent exploitation.

Sources

  • National Vulnerability Database (NVD) - https://nvd.nist.gov/vuln/detail/CVE-2026-72522