CVE detail
CVE-2026-72522
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 17.9 · diversity 18.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 5
- within the 30d window
- Peak daily
- 3
- highest bucket
Evidence
Source links by recency
5 source links · newest first
Linked URL: https://blog.hartwork.org/posts/expat-2-8-3-released/ | Posted by spyc | 1 points | 0 comments
communitynews.ycombinator.comAug 11, 2026, 1:23 PMInformation published.
vendormsrc.microsoft.comAug 11, 2026, 8:08 AM- http://www.openwall.com/lists/oss-security/2026/08/11/5www.openwall.com
No excerpt available.
Exploitwww.openwall.comAug 10, 2026, 4:16 AM No excerpt available.
Exploitgithub.comAug 10, 2026, 4:16 AM- https://bugzilla.mozilla.org/show_bug.cgi?id=2053153bugzilla.mozilla.org
No excerpt available.
Exploitbugzilla.mozilla.orgAug 10, 2026, 4:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-19955CVSS 2.0 · Low
A vulnerability was detected in TrailDB 0.6. Impacted is the function tdb_open of the file /src/tdb.c of the component TOC Validation. The manipulation results in out-of-bounds re…
- CVE-2026-49282CVSS 5.1 · Medium
Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's public `cs_insn_name()` API forwards caller-supplied instruction IDs directly to the selected archit…
- CVE-2026-18020CVSS 5.3 · Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.
- CVE-2026-17649CVSS 5.3 · Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
- CVE-2026-17226CVSS 5.4 · Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.
- CVE-2026-17212CVSS 5.3 · Medium
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.