Description

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-10T04:16:50.910Z",
  "pubdate": "2026-08-10T04:16:50.910Z",
  "executiveSummary": "An out-of-bounds read and resulting infinite loop vulnerability exists in libexpat prior to version 2.8.3.\nThe flaw manifests during Unicode processing within the *_toUtf16 functions when handling low surrogates.\nSpecifically, the parser incorrectly treats low surrogate code points identically to high surrogate code points.\nThis improper validation leads to memory parsing anomalies, resulting in an out-of-bounds read condition and subsequent infinite loop execution.\nAttackers can leverage this vulnerability by supplying maliciously crafted XML data containing anomalous surrogate character sequences to an application utilizing the vulnerable libexpat library.\nSuccessful exploitation causes a denial of service (DoS) condition by exhausting CPU resources through the infinite processing loop.\nThe vulnerability impacts any system processing untrusted XML inputs using affected versions of libexpat.\nNo specific authentication or elevated privileges are strictly required if the targeted application parses untrusted network or file inputs directly.",
  "technicalDetails": "The vulnerability resides in the Unicode conversion routines, specifically the *_toUtf16 functions implemented within libexpat prior to version 2.8.3.\nThe fundamental root cause is improper input validation and state handling during surrogate pair processing in UTF-16 transformations.\nIn the Unicode standard, surrogate pairs consist of a high surrogate (range U+D800 to U+DBFF) followed by a low surrogate (range U+DC00 to U+DFFF).\nIn the vulnerable versions of libexpat, low surrogates are incorrectly treated in the same manner as high surrogates during the internal character mapping execution flows.\nWhen an input stream presents a low surrogate out of sequence or improperly categorized, the decoding logic fails to advance the input pointer correctly or enters an erroneous state machine loop.\nAs the parsing function attempts to read character sequences, this misclassification triggers an out-of-bounds read condition as memory boundaries are miscalculated relative to the current stream position.\nFollowing the out-of-bounds read, the parsing state fails to terminate or make forward progress through the input buffer, driving the execution flow into an infinite loop.\nThe attack vector involves an unauthenticated attacker delivering a crafted XML document payload containing malformed surrogate sequences to an endpoint that parses the XML via libexpat.\nWhen the vulnerable application processes the malicious payload, the parsing thread hangs indefinitely in the infinite loop, consuming 100 percent of the CPU core allocated to the process.\nThis behavior directly induces a denial of service, potentially halting critical application services or causing cascading resource exhaustion across dependent systems if multiple parsing threads are simultaneously targeted."
}