Home / mailings [SECURITY] [DSA 6446-1] expat security update
Posted on 18 August 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6446-1 security@debian.org
https://www.debian.org/security/ Aron Xu
August 18, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : expat
CVE ID : CVE-2026-72522
Debian Bug : 1144064
A flaw was discovered in the UTF-16 decoding support of expat, an XML
parsing C library, where low surrogates were treated in the same way as
high surrogates. Parsing crafted XML input may result in an out-of-bounds
read and a resultant infinite loop, leading to denial of service. Only
builds with 16 bit character support are affected, which in Debian is the
libexpatw library shipped in the libexpat1 package.
In addition, this update corrects a regression introduced in the previous
security update (DSA-6404-1): on 32 bit architectures, documents larger
than 2 GiB were incorrectly rejected with an out of memory error.
For the stable distribution (trixie), this problem has been fixed in
version 2.8.3-1~deb13u1.
We recommend that you upgrade your expat packages.
For the detailed security status of expat please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/expat
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
