The libexpat library prior to version 2.8.3 contains a vulnerability classified as CWE-125 (Out-of-bounds Read). The flaw occurs in the *_toUtf16 functions where low surrogate Unicode characters are mishandled as if they were high surrogates. This results in an out-of-bounds read and can cause an infinite loop during Unicode processing. The vulnerability has a CVSS 3.1 base score of 6.2, indicating a medium severity primarily due to its potential to cause denial of service (availability impact). There is no indication of confidentiality or integrity impact. No official patch or remediation level is provided in the available data, and no known exploits are reported in the wild.

This vulnerability can cause an application using libexpat to enter an infinite loop or crash, resulting in a denial of service. There is no impact on confidentiality or integrity. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor libexpat updates and consider mitigating the risk by limiting exposure to untrusted input that triggers this Unicode processing path.