libexpat CVE-2026-72522

Exploitation requires libexpat to be compiled with both XML_UNICODE and XML_UNICODE_WCHAR_T compile-time flags, enabling 16-bit wide-character (UTF-16) output mode. This is confirmed explicitly by the vendor's patch changelog: 'Needs Expat compiled with 16bit character support (e.g. with Firefox and/or on Windows) to be affected.' The attacker must supply XML input containing a low Unicode surrogate (U+DC00-U+DFFF) positioned to trigger the *_toUtf16 conversion, for example within attribute values or entity definitions in DOCTYPE declarations. The CVSS vector specifies PR:N/UI:N, meaning no authentication or user interaction is required from the parser's perspective once the application exposes libexpat to attacker-controlled XML. The primary limiting factor is the compile-time prerequisite: standard Linux/Unix builds of libexpat distributed without XML_UNICODE are completely immune regardless of version. Environments exclusively affected are Firefox builds and Windows-native applications embedding libexpat with wide-character support.

Two CVSS vectors exist for this CVE and they conflict materially: NVD assigned AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 6.2), while the vendor's own patch changelog explicitly documents AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) - the AV:L assignment appears to be an NVD error, since Firefox parsing attacker-supplied web XML represents a clear network attack vector. No EPSS score was provided in the intelligence data, so exploitation probability cannot be precisely quantified. KEV status is negative, and no confirmed active exploitation exists. A test-case payload attributed to Jason Kratzer of Mozilla is publicly available in the upstream PR, demonstrating the attack is reproducible. The compile-time gate (XML_UNICODE + XML_UNICODE_WCHAR_T) meaningfully reduces real-world attack surface - even a mid-sized IT team in malbork running standard Linux-packaged libexpat compiled without 16-bit Unicode support would be completely unaffected despite running an unpatched version. The 'Information Disclosure' tag in the intelligence metadata is misleading: the official CVSS C:N metric confirms no assessed confidentiality impact, and the mechanism is an infinite loop rather than data exfiltration. Net assessment: elevated priority for Firefox maintainers and Windows application vendors shipping libexpat; negligible priority for standard Linux/Unix deployments.

An attacker serves a crafted XML document embedding a low surrogate code unit (e.g., U+DC00) within an attribute value or entity reference payload to a Firefox browser or a Windows application parsing attacker-controlled XML via libexpat compiled with 16-bit Unicode support. The *_toUtf16 function enters an infinite loop at the surrogate boundary, consuming 100% of the parsing thread's CPU indefinitely and rendering the XML-consuming application completely unresponsive. A concrete test-case payload demonstrating this behavior - constructed around a specific buffer boundary of approximately 1021-1025 bytes - is publicly available in PR #1296 of the upstream libexpat repository.