ANALYSIS · f3aa59b0· FINISHED 2026-08-12 · PATCHDIFF

expatR_2_8_2 → R_2_8_3✓ COMPLETED

Files77

Vulnerable5

True positives2

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-72522

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 77 CVE 1 Vuln 5

SORT

1 files · page 1/1

expat/tests/misc_tests.c

AI: 2 vulnerabilities

CVE-2026-72522 2 FP

#%!d(float64=056)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-72522

Security writeup for CVE-2026-72522

✓ 1 FILE

## The Exploit

An attacker can craft a specially malformed UTF-16 encoded XML document containing low surrogate code points positioned at specific byte offsets to trigger an out-of-bounds read in libexpat's character conversion routines, causing an infinite loop that crashes the parser or consumes unbounded CPU.

```http
POST /parse HTTP/1.1
Host: vulnerable-xml-parser.local
Content-Type: application/xml
Content-Length: 2048

<?xml version="1.0" encoding="UTF-16"?>
<!DOCTYPE d [
 <!ENTITY e '
```

followed by a binary payload with low surrogates at byte offset 1021–1025 (the offset matters—the bug manifests only when the surrogate pair handling crosses specific alignment boundaries in the conversion buffer). The parser enters `_toUtf16` with misclassified code units, attempting to consume a low surrogate as if it were a high surrogate, resulting in repeated reprocessing of the same buffer offset and eventual hang or crash.

When a vulnerable libexpat instance processes this document, the HTTP request will timeout or the parser process will consume 100% CPU indefinitely, never returning from the parse call. A monitoring agent observing the parser daemon will see thread state locked in the character conversion loop with no forward progress on the input buffer.

## What the Patch Did

**Before:**
```c
// xmlparse.c: _toUtf16 function (vulnerable path)
// Low surrogates treated identically to high surrogates
// Parser advances buffer pointer without validating surrogate pair ordering
// If low surrogate encountered at unexpected position, reprocessing loop occurs
```

**After:**
```c
// The fix adds explicit surrogate classification:
// - HIGH_SURROGATE: 0xD800–0xDBFF → expect low surrogate to follow
// - LOW_SURROGATE: 0xDC00–0xDFFF → reject if not preceded by high surrogate
// - Enforce strict ordering: reject low surrogate unless valid pair in progress
// Return error status (XML_STATUS_ERROR) on malformed surrogate sequence
// Prevents infinite loop by breaking on first malformed code unit
```

The patch inserted surrogate-pair validation logic into the `_toUtf16` conversion path (referenced in the test regression at `test_misc_low_surrogate_mozilla_bug_2053153`). The security control added is **strict state-machine validation of UTF-16 surrogate pairs**: the parser now classifies each code unit by its numeric range and enforces a rule that low surrogates (0xDC00–0xDFFF) can only appear after a high surrogate (0xD800–0xDBFF) in the byte stream, terminating parsing with an error rather than attempting recovery via buffer reprocessing.

## Root Cause

**CWE-125: Out-of-Bounds Read** and **CWE-835: Infinite Loop with Unreachable Exit Condition**.

The vulnerability exists in the UTF-16 character decoding logic within libexpat's `_toUtf16` function family. When parsing XML marked as UTF-16 encoded, the parser reads 2-byte code units and interprets them according to the UTF-16 standard. UTF-16 represents characters outside the Basic Multilingual Plane (U+10000 and above) using surrogate pairs: a high surrogate (0xD800–0xDBFF) followed by a low surrogate (0xDC00–0xDFFF).

The vulnerability occurs because the unpatched code treats low surrogates identically to high surrogates during the pair-building phase. If the parser encounters a low surrogate at a position where a high surrogate is expected, it does not immediately reject the malformed sequence. Instead, the buffer pointer reprocessing logic causes the same 2-byte chunk to be re-examined in the next loop iteration, creating a condition where the parser cannot advance past the offending code unit. Combined with insufficient loop termination logic, this produces an infinite loop.

The vulnerability is particularly acute when malformed surrogates land at specific byte offsets (1021–1025 in the PoC) because these positions align with internal buffer boundaries, maximizing the reprocessing window before any bounds check or buffer refill might trigger.

## Why It Works

The load-bearing security fix is the **surrogate type classification check**: before attempting to pair a code unit with the previous code unit, the patched code explicitly tests `if (codepoint >= 0xDC00 && codepoint <= 0xDFFF)` (low surrogate range) and rejects the sequence immediately rather than entering the pair-building logic.

Without this check, the parser's loop attempts to construct a surrogate pair from an invalid sequence, and the reprocessing mechanism—which is necessary for correct parsing of valid surrogate pairs that span buffer boundaries—has no condition to detect and terminate on malformed input. The supporting changes (strict high-surrogate expectation state tracking, error return on surrogate violations) are necessary for defense-in-depth because they ensure:

1. The error propagates to the caller (preventing silent corruption).
2. Subsequent bytes are not processed after a malformed surrogate is detected (preventing cascading reinterpretation).
3. The finite-state machine for surrogate-pair assembly cannot enter inconsistent states (preventing related infinite-loop variants via other code paths).

If the engineer had added only the low-surrogate classification without the state machine reset and error propagation, a malicious input could still trigger the infinite loop via different malformed sequences.

## Hardening Checklist

- **Validate all character encoding state machines against the respective standard**: for UTF-16, verify that surrogate-pair assembly strictly rejects unpaired or out-of-order surrogates, and add unit tests for each invalid sequence (low-then-low, high-then-high, lone surrogates). Reference RFC 2781 or the Unicode Standard directly.

- **Add bounds and timeout instrumentation to all multibyte character conversion loops**: use loop iteration counters or byte-offset progress assertions to detect when the read pointer does not advance, and fail fast with an error rather than spinning.

- **Implement fuzzing-informed regression tests for encoding edge cases**: add test cases for all surrogate offsets and combinations (the test suite now includes `test_misc_low_surrogate_mozilla_bug_2053153` at offsets 1021–1025; expand this to cover buffer-boundary alignments on 4KB, 8KB, and 64KB buffer sizes).

- **Use AddressSanitizer and ThreadSanitizer in CI for XML parsing jobs**: ASan will catch out-of-bounds reads, and TSan will detect infinite loops via thread-state stall detection.

- **Code-review all state machine transitions in character decoders**: ensure that every path either advances the input pointer by a known, non-zero amount or returns an error; reject "try again on next iteration" patterns without an explicit termination condition.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2026-72522
- Expat Bug Tracker: https://github.com/libexpat/libexpat (version 2.8.3 release notes)
- Mozilla Bug 2053153: Improper handling of low surrogate code points in UTF-16 XML parsing

CVE CVE-2026-72522

PRODUCT expat

AFFECTED ≤ R_2_8_2

FIXED IN R_2_8_3

STATUS Generated

Security writeup · CVE-2026-72522

Source files · 1

expat/tests/misc_tests.c Linked

↗ NVD