PT-2026-69331

CVE-2026-72522

·

Published

2026-08-10

·

Updated

2026-10-21

Description by

CVSS 3.1
6.2
Medium
MetricsAV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.8.3
Description An out-of-bounds read and a resulting infinite loop occur during Unicode processing. This happens because low surrogates are treated identically to high surrogates within the * toUtf16 functions.
Recommendations Update libexpat to version 2.8.3 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-125: Out-of-bounds Read
Related identifiers
CVE-2026-72522
AZL-94698
CLSA-2026-1786976393
CLSA-2026-1788864771
CLSA-2026-1788869942
CLSA-2026-1788953221
ECHO-DE7D-DEEA-1F3E
OESA-2026-3403
OESA-2026-3957
OESA-2026-3958
OESA-2026-3959
OESA-2026-3960
OESA-2026-4115
OPENSUSE-SU-2026:11733-1
OPENSUSE-SU-2026:11756-1
OPENSUSE-SU-2026:21945-1
OPENSUSE-SU-2026:22139-1
RHSA-2026:54869
SUSE-SU-2026:23743-1
SUSE-SU-2026:23894-1
SUSE-SU-2026:23912-1
SUSE-SU-2026:24260-1
SUSE-SU-2026:4534-1
SUSE-SU-2026:4615-1
SUSE-SU-2026:4619-1
SUSE-SU-2026:4623-1
SUSE-SU-2026:4736-1
SUSE-SU-2026:4806-1
SUSE-SU-2026:4834-1
USN-8813-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com