CVE-2026-72522

CVE-2026-72522 is an out-of-bounds read in libexpat's UTF-16 conversion layer that causes infinite loops when processing malformed Unicode input. Specifically, the parser accepts lone low surrogates (U+DC00–U+DFFF) as valid code points rather than requiring them to follow a high surrogate in a valid pair. This triggers an infinite loop in the *_toUtf16 functions, hanging the thread rather than crashing cleanly. This matters more than the CVSS 6.2 score suggests. The infinite-loop outcome is analytically significant—it wedges threads silently, evades typical crash detection, and exhausts thread pools or event loop capacity in async architectures. More critically, libexpat is embedded infrastructure: Python's xml.etree, PHP's DOM, Apache's mod_dav, Firefox's layout engine, and countless embedded systems depend on it. A hung parser means a hung request handler, script, or browser tab. The blast radius of a 'medium' library bug is structurally larger than an equivalent application-level flaw because the library doesn't get updated when the applications shipping it do. When evaluating the fix in version 2.8.3, examine whether it implements proper stateful surrogate tracking—a 'high surrogate pending' flag that persists across bytes—rather than just adding a pattern-matching filter to reject lone low surrogates. The former is a robust architectural fix; the latter is a heuristic that future Unicode edge cases (noncharacters, newline sequences in surrogate contexts) could bypass. Diff the UTF-16 conversion functions in 2.8.2 versus 2.8.3 and look for new state variables versus new conditional branches. Also note: the CVSS Scope designation for this class of vulnerability is arguably wrong. When a library vulnerability enables effects that exceed the library's security boundary and affect the embedding application's privileges (root, sandbox, runtime), Scope should be set to Changed, not Unchanged. If correctly scored as Scope Changed, the base score increments by approximately 1.5 points—a nontrivial adjustment that better represents the propagation risk. Your priority: verify the fix quality first (stateful vs. heuristic), then treat this as higher-than-assigned severity for environments with slow update cycles. In embedded systems and LTS distributions where libexpat ships with the application and doesn't get updated independently, the effective remediation window is the downstream deployment cycle, typically 3–6x longer than the upstream patch cycle.

Reviewed through automated stages and approved by a human before publication.