Hartwork Blog · Expat 2.8.3 released, fixes vulnerability CVE-2026-72522
Skip to main content
Hartwork Blog
Free Software, Music, Chinese Chess
Expat 2.8.3 released, fixes vulnerability CVE-2026-72522
2026-08-11 13:38
For readers new to Expat:
libexpat is a fast streaming XML parser.<br>Alongside libxml2, Expat is one of the<br>most widely used<br>software libre XML parsers written in C, specifically C99.<br>It is cross-platform and licensed under<br>the MIT license.
Expat 2.8.3<br>was released<br>yesterday.<br>The key motivation for cutting a release and doing so now<br>was getting…
the fix to vulnerability CVE-2026-72522 as well as
the fix to a regression in Expat 2.8.2
…out to users.
The vulnerability was reported by the Mozilla Security Team,<br>and it relates to how Expat handles decoding of<br>UTF-16.<br>The vulnerability is technically an<br>out-of-bounds read, and<br>the symptom in practice is (easy and reliable)<br>denial of service<br>by means of an infinite loop.<br>It should be noted that the CVSS vector by Mitre for<br>CVE-2026-72522<br>in the National Vulnerability Database is<br>(once again) misclassifying<br>the attack vector as Local (L) when it should be Network (N):<br>there are no requirements for<br>local access with<br>CVE-2026-72522.
The regression was that on 32bit platforms and on 64bit Windows,<br>processing XML content of 2+ GiB size<br>was rejected as "out of memory" by mistake.<br>The issue was reported by Evgeny Kotkov<br>a week ago in the context of Subversion's use of libexpat.
Thanks to everyone who contributed to this release of Expat!
For more details about this release, please<br>check out the change log.
If you maintain Expat packaging,<br>a bundled copy of Expat, or<br>a pinned version of Expat,<br>please update to version 2.8.3. Thank you!
Sebastian Pipping