Most recent entries from all

BELL-CVE-2026-72522

Affected: Alpaquita:23: expat, Alpaquita:25: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:25: expat, BellSoft Hardened Containers:stream: expat

EUVD-2026-351985

fkie_cve-2026-72522

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

GHSA-v867-w97p-3vx2

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

msrc_CVE-2026-72522 — libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same…

msrc_CVE-2026-72522

OESA-2026-3403 — expat security update

Affected: openEuler:24.03-LTS-SP4: expat, openEuler:20.03-LTS-SP4: expat, openEuler:22.03-LTS-SP4: expat, openEuler:24.03-LTS-SP1: expat, openEuler:24.03-LTS-SP3: expat

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fix(es):

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.(CVE-2026-72522)

openSUSE-SU-2026:11733-1 — expat-2.8.4-1.1 on GA media

expat-2.8.4-1.1 on GA media

RHSA-2026:54869 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

expat: libexpat: Denial of Service due to incorrect Unicode surrogate handling

SUSE-SU-2026:23743-1 — Security update for python311

Security update for python311

UBUNTU-CVE-2026-72522

Affected: Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver, Ubuntu:Pro:16.04:LTS: coin3 and 57 more

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

WID-SEC-W-2026-2718 — expat: Schwachstelle ermöglicht Denial of Service

Ein lokaler Angreifer kann eine Schwachstelle in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.