CVE-2026-72522: libexpat DOS Vulnerability

CVE-2026-72522 Overview

CVE-2026-72522 is an out-of-bounds read vulnerability in libexpat before version 2.8.3. The flaw resides in the *_toUtf16 functions, where low surrogates are treated the same as high surrogates during Unicode processing. This incorrect handling causes an out-of-bounds read and a resultant infinite loop, leading to denial of service on applications that parse untrusted XML input. The issue is tracked under CWE-125: Out-of-bounds Read. Because libexpat is embedded in a wide range of language runtimes, browsers, and system utilities, the vulnerability affects any downstream software that consumes attacker-controlled XML through the affected UTF-16 conversion path.

Critical Impact
Local attackers can trigger an infinite loop and out-of-bounds read in the libexpat XML parser, causing denial of service in any application that processes untrusted XML through the affected UTF-16 conversion routines.

Affected Products

libexpat versions prior to 2.8.3
Applications and language runtimes that statically or dynamically link libexpat for XML parsing
Operating system packages that bundle vulnerable versions of libexpat

Discovery Timeline

2026-08-10 - CVE-2026-72522 published to the National Vulnerability Database
2026-08-11 - Public discussion on the Openwall OSS-Security mailing list
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72522

Vulnerability Analysis

The vulnerability affects the *_toUtf16 conversion functions inside libexpat. These routines are responsible for translating input character sequences into UTF-16 code units during XML parsing. Unicode defines surrogates in two categories: high surrogates in the range U+D800–U+DBFF and low surrogates in the range U+DC00–U+DFFF. A valid UTF-16 surrogate pair requires a high surrogate followed by a low surrogate.

In the affected code path, libexpat fails to distinguish between the two surrogate ranges and treats low surrogates as if they were high surrogates. This misclassification causes the parser to consume beyond the intended buffer boundary and enter an unrecoverable state, leading to both an out-of-bounds read and an infinite loop. The result is CPU exhaustion of the process performing the XML parsing.

Root Cause

The root cause is improper input validation of surrogate ranges within the UTF-16 conversion functions. The conditional logic that identifies high surrogates does not exclude the low surrogate range, so any input containing a lone low surrogate advances the parser incorrectly. Once the parser advances past valid data, it re-enters the same code path with the same malformed state, producing the infinite loop.

Attack Vector

Exploitation requires a local attack vector with no privileges and no user interaction, but has high impact on availability. An attacker supplies a crafted XML document containing malformed surrogate sequences to any application that parses it through libexpat. When the parser reaches the malformed surrogate, it reads past the end of the intended buffer and enters an infinite loop, causing the host process to consume CPU indefinitely until terminated. See the libexpat GitHub Pull Request #1296 for the technical fix details.

Detection Methods for CVE-2026-72522

Indicators of Compromise

Processes linked against libexpat consuming 100% CPU on a single thread while parsing XML input
Application hangs or timeouts correlated with the receipt of XML documents containing unpaired UTF-16 surrogate code units
Repeated crashes or watchdog terminations of services that expose XML parsing to local users

Detection Strategies

Inventory installed libexpat versions across Linux, macOS, and Windows hosts and flag any version earlier than 2.8.3
Identify applications and language runtimes (Python, Perl, PHP, etc.) that bundle a private copy of libexpat and audit their vendored version
Monitor for XML input containing isolated code units in the U+DC00–U+DFFF range being submitted to parsing services

Monitoring Recommendations

Alert on sustained single-thread CPU saturation by XML-handling processes such as configuration loaders, document converters, and RPC endpoints
Track abnormal process runtimes for scheduled jobs that ingest XML from untrusted sources
Log and review termination events for services that unexpectedly exceed CPU or wall-clock limits after receiving external input

How to Mitigate CVE-2026-72522

Immediate Actions Required

Upgrade libexpat to version 2.8.3 or later on all affected systems
Rebuild or update applications and language runtimes that statically link libexpat against the patched release
Restrict local access to services that parse XML from user-supplied sources until patched packages are deployed

Patch Information

The fix is available in libexpat version 2.8.3. The upstream change is documented in libexpat GitHub Pull Request #1296, which corrects the surrogate classification logic in the *_toUtf16 functions. Downstream vendors are expected to publish package updates; see the Openwall OSS-Security Discussion and the Mozilla Bug Report #2053153 for distribution tracking.

Workarounds

Enforce process-level CPU and wall-clock limits on XML-parsing workers using ulimit, systemd resource controls, or container quotas
Validate or reject XML input containing unpaired UTF-16 surrogate code units at an upstream gateway before it reaches libexpat
Disable optional features that route untrusted input through the affected UTF-16 conversion path where feasible

bash

# Example: apply per-service CPU and time limits with systemd
# /etc/systemd/system/xml-parser.service.d/limits.conf
[Service]
CPUQuota=50%
RuntimeMaxSec=30
MemoryMax=512M