Log in Start free

Vulnerability · Published Aug 10, 2026 · Assigned by mitre

CVE-2026-72522

Medium 6.2

In plain English

A medium-severity out-of-bounds read in libexpat from libexpat project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.2%top 91.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12expat2.5.0-1+deb12u3DEBIAN-CVE-2026-72522
Debian:13expat2.8.3-1~deb13u1DEBIAN-CVE-2026-72522
Debian:14expat2.8.3-1DEBIAN-CVE-2026-72522
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-72522
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-72522
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.9USN-8813-1
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.9UBUNTU-CVE-2026-72522
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.6UBUNTU-CVE-2026-72522
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.6USN-8813-1
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.2UBUNTU-CVE-2026-72522
Ubuntu:26.04:LTSexpat2.7.4-1ubuntu0.2USN-8813-1
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-72522
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-72522
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-72522
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-72522
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-72522
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-72522
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-72522
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-72522

Affected products (as reported)

VendorProductVersions
libexpat project libexpat 0 – before 2.8.3

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References