CVE-2026-72522 in Libexpat
Summary
by MITRE • 08/10/2026
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability exists within the libexpat library version 2.8.3 and earlier, specifically affecting the Unicode processing mechanisms during XML parsing operations. This issue stems from an improper handling of surrogate pairs in the UTF-16 conversion functions, where low surrogates are incorrectly treated with the same processing logic as high surrogates. The flaw manifests when the library encounters malformed Unicode sequences during XML document parsing, particularly in scenarios involving invalid UTF-16 encoding.
The technical implementation defect occurs within the *_toUtf16 functions that process Unicode characters during XML parsing. When the parser encounters a surrogate pair sequence, it fails to properly distinguish between high surrogates and low surrogates, leading to an out-of-bounds memory read condition. This misclassification causes the parser to access memory locations beyond the intended buffer boundaries, creating unpredictable behavior and potential system instability. The vulnerability is categorized under CWE-129 as an insufficient input validation, specifically related to improper handling of surrogate pairs in Unicode processing.
During normal operation, this vulnerability can lead to a denial of service condition through infinite loop execution, where the parser enters a continuous processing cycle due to the malformed surrogate handling. Attackers can exploit this by crafting specially formatted XML documents containing invalid Unicode sequences that trigger the problematic code path. The infinite loop occurs because the parser's state machine becomes stuck in an unrecoverable condition when processing the misclassified surrogate pairs, consuming excessive CPU resources and potentially causing system resource exhaustion.
The operational impact of this vulnerability extends beyond simple denial of service, as it can affect any application or system that relies on libexpat for XML parsing operations. This includes web servers, database systems, and enterprise applications that process user-supplied XML content. The vulnerability affects both client-side and server-side implementations, making it particularly dangerous in environments where untrusted XML data is processed. Organizations using affected versions should prioritize immediate patching to prevent exploitation, as the infinite loop condition can be leveraged for resource exhaustion attacks.
Mitigation strategies include upgrading to libexpat version 2.8.3 or later, which contains the necessary fixes for proper surrogate pair handling. Additionally, implementing input validation measures such as XML schema validation and content filtering can help reduce the attack surface by preventing malformed Unicode sequences from reaching the vulnerable parsing functions. Network-based protections like web application firewalls can also be configured to detect and block suspicious XML patterns that might trigger this vulnerability. The fix implements proper surrogate pair classification and boundary checking, ensuring that low surrogates are handled according to Unicode standards while maintaining compatibility with legitimate UTF-16 encoded content. This vulnerability aligns with ATT&CK technique T1203 as a form of resource exhaustion attack, while also representing a potential entry point for more sophisticated exploitation attempts through malformed input processing.