Hi,

The following vulnerability was published for expat.

CVE-2026-72522[0]:
| libexpat before 2.8.3 has an out-of-bounds read and resultant
| infinite loop because low surrogates are treated the same as high
| surrogates during Unicode processing in the *_toUtf16 functions.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-72522
https://www.cve.org/CVERecord?id=CVE-2026-72522
[1] https://github.com/libexpat/libexpat/pull/1296

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
expat, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144064@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <gcs@debian.org> (supplier of updated expat package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 11 Aug 2026 06:52:38 +0200
Source: expat
Architecture: source
Version: 2.8.3-1
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Closes: 1144064
Changes:
 expat (2.8.3-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-72522: out of bounds read and resultant infinite loop
       (closes: #1144064).
Checksums-Sha1:
 9f39ca05bc198eed87de1a820d921da6501c4c7a 1970 expat_2.8.3-1.dsc
 634727e5c97647ddaa90687d33e3a8324d317fcc 8464226 expat_2.8.3.orig.tar.gz
 0f54354b7369520339e8a539a82a2c4fc5e844e1 14044 expat_2.8.3-1.debian.tar.xz
Checksums-Sha256:
 234090d3535cfceb09f61b9f97d14f8a0afe51f04bd26a077bc83092543f9ab3 1970 expat_2.8.3-1.dsc
 533659a16e0184035a99fd8e783f1ad61a887a7bf8586a8681740b9d7ed42389 8464226 expat_2.8.3.orig.tar.gz
 c9817a59c9f9a56b689651a38e94d6ac403eb19e7146af76bd29f081948a443e 14044 expat_2.8.3-1.debian.tar.xz
Files:
 62305e3c61d8186f6996f7360b4053a9 1970 text optional expat_2.8.3-1.dsc
 63cb21352b02ab04011d0b49c0e11ec6 8464226 text optional expat_2.8.3.orig.tar.gz
 6ef3c503b7686bc9fcf44edeebe4d8a2 14044 text optional expat_2.8.3-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmp6q+0ACgkQ3OMQ54ZM
yL8r7g/+JLVg5N6fek1fUNeBtDQJjOE+ISwA2Zt4KYrlwH69MgKR07iZGexhL6z/
y/ph2xRPnFYkWiKTDzelO0drNuOvJwE5ijq5RQ3VIE7i+ZIYiimDLCCwG/bWx2jS
uk0FBYd12RD5loZ+J1Do9/Fo1cbRercyLeIUD9WwtOWXUvDv4MGsZbBdUs+OFgC/
6eaRFS6bdMeCvYGRIDdqRhYdCSoRke+5eQhP1avHQCqs/dmId/pyuHMSM3bcO1Se
YquluP1NKEc9bLmclyAaRIgboM1D0TYwT+akX2gvc4NwgZpTHQa1f7XTdPYIAMK5
gQcnkpiANF0bGd1xwpoKtv0Dbh/uGxW0RSFRKbAyKhboYWUi1gBKRXd7Yr8y0GDK
bTgVWuFMtw1+JWd/vgfSl8w9FwRsWmgVFKERq76+O2ZUQqioX6mKYZOtTcd5QeOq
n97TqDzovULoinLASD2yyGC/ttFOY0QO8w0ANpINYpPrOGMU8DTe632h1gQarZ7n
51eLV2VZ7Ic6WpgL4zcY8G+SjmrKhb5DDPkMMtIBXqk3zUVFmvtv/QpYr/0pAwjK
tULhDfGNMZaZDPJdxL+qAVMHXuw5YHKKMFL8YeGKp1iPjlvOJWHEVRnqbsh0OgVC
MoTU6P0iEcxNTWymyktW9+icr395hyknHwm9gbmg1UUWVwQCTI0=
=Nk3b
-----END PGP SIGNATURE-----