Debian DSA-6446-1: expat UTF-16 decoding OOB Read & DoS (CVE-2026-72522)

Vulnerability Overview Vulnerability Name: DSA 6446-1 expat security update Publication Date: August 18, 2026 Vulnerability Description: A flaw was discovered in the UTF-16 decoding support where low surrogate items were treated as high surrogates. Parsing carefully crafted XML input could lead to out-of-bounds reads and infinite loops, resulting in denial of service. Only builds utilizing 16-bit character support are affected, and this issue exists in the library package within Debian. Additional Fix: This update also resolves a regression issue introduced in the previous security update (DSA-6444-1), where documents larger than 2GB were incorrectly rejected due to a memory error on 32-bit architectures. Impact Scope Affected Software: expat CVE ID: CVE-2026-72522 Debian Bug: 1144064 Affected Versions: The library package in Debian Stable Release (trixie): The issue has been fixed in version 2.8.3-1deb1u1 Remediation Recommended Action: It is recommended to upgrade the package. Detailed Security Status: For further details, refer to the expat security tracking page: https://security-tracker.debian.org/tracker/expat More Information: Regarding Debian security announcements, instructions on how to apply these updates to your system, and a frequently asked questions section, visit: https://www.debian.org/security/ POC Code or Exploit Code No POC code or exploit code is included in the page. Other Information Mailing List: debian-security-announce@lists.debian.org PGP Signature: A PGP signature is included at the bottom of the page to verify the authenticity of the email. Summary This security update resolves a UTF-16 decoding flaw in the expat library, preventing denial-of-service attacks caused by out-of-bounds reads and infinite loops, and fixes a regression issue from the previous update. Users are advised to upgrade the package to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Debian DSA-6446-1: expat UTF-16 decoding OOB Read & DoS (CVE-2026-72522)

More from this source