Medium severity6.2NVD Advisory· Published Aug 10, 2026· Updated Aug 31, 2026

CVE-2026-72522

Description

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

osv-coords2 versions
pkg:rpm/opensuse/python311&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/expat&distro=openSUSE%20Tumbleweed
< 3.11.16-1.1+ 1 more
- (no CPE)range: < 3.11.16-1.1
- (no CPE)range: < 2.8.4-1.1
Libexpat Project/Libexpatllm-fuzzy
Range: <2.8.3

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/08/11/5nvd
bugzilla.mozilla.org/show_bug.cginvd
github.com/libexpat/libexpat/pull/1296nvd

News mentions

No linked articles in our index yet.

cvss	0.403
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000