CVE-2026-72522 is a vulnerability in libexpat's _toUtf16 functions where Unicode low surrogates are incorrectly treated as high surrogates. This results in an out-of-bounds read that can trigger an infinite loop during XML parsing, causing a denial of service via high CPU consumption and resource exhaustion. The vulnerability affects Red Hat Hardened Images RPMs, specifically expat packages version 2.8.3-0.1.hum1 for aarch64 and x86_64 architectures. The flaw is categorized under CWE-125 (Out-of-bounds Read). Red Hat has published an advisory (RHSA-2026:54869) describing the issue and recommending mitigations but has not yet released a patch. The vulnerability requires local attack vector with low attack complexity and no privileges or user interaction, impacting availability but not confidentiality or integrity.

An attacker can cause a denial of service by providing specially crafted XML input that triggers an infinite loop in libexpat's Unicode surrogate handling. This leads to high CPU usage and system resource exhaustion, potentially causing application or system instability. There is no direct impact on confidentiality or integrity. The vulnerability does not currently have known exploits in the wild.

No official patch or fix is currently available. Mitigation involves limiting exposure by restricting parsing of untrusted or unverified XML inputs and validating incoming XML documents for malformed character sequences before processing. Additionally, enforcing process-level CPU resource limits and parsing timeouts can help prevent system-wide denial of service from infinite parsing loops. Monitor Red Hat advisories for updates regarding a forthcoming fix.