CVE-2026-72522 is a denial of service vulnerability in libexpat's _toUtf16 functions where low Unicode surrogates are incorrectly treated as high surrogates. This causes an out-of-bounds read and an infinite loop when parsing specially crafted XML input, resulting in high CPU consumption and potential system resource exhaustion. The vulnerability affects libexpat versions prior to 2.8.3-0.1.hum1 and 1.59.02-4.oe2403sp4. Red Hat has released updated packages (expat-2.8.3-0.1.hum1) to fix this issue. The vulnerability is tracked as CWE-125 (Out-of-bounds Read) and has a CVSS v3.1 score of 6.2 (medium severity) with an attack vector of local and low complexity.

An attacker who can provide specially crafted XML input to an application using vulnerable libexpat versions can trigger an out-of-bounds read and infinite parsing loop. This leads to denial of service by causing high CPU usage and exhaustion of system resources. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been documented.

A patch is available and should be applied by upgrading libexpat to version 2.8.3-0.1.hum1 or later. Until patched, mitigate risk by restricting parsing of untrusted or unverified XML inputs and validating XML documents for malformed character sequences before processing. Additionally, enforce process-level CPU resource limits and parsing timeouts to prevent system-wide denial of service from infinite parsing loops.