mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 12:49:33 +02:00
011c32f047
CVE-2026-72522 is an out-of-bounds read and infinite loop vulnerability in
Expat's *_toUtf16 functions caused by mis-classifying low surrogates as
high surrogates.
Our Yocto configuration is not affected by this vulnerability:
- Expat is compiled with EXPAT_CHAR_TYPE=char (8-bit character representation).
- Neither XML_UNICODE nor XML_UNICODE_WCHAR_T is defined.
- The vulnerable *_toUtf16 functions are only invoked when Expat's internal
character type is 16-bit (ushort or wchar_t).
- In 8-bit mode, Expat handles conversion using *_toUtf8 functions even when
parsing UTF-16 encoded XML inputs, rendering the vulnerable code path
unreachable.
Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-72522
[2] 8fbfb52fa8
(From OE-Core rev: dbdc9e8d18374a2586c24e1ba41bfa1dcba3ef39)
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
[YC: EXPAT_CHAR_TYPE=char is the default and we do not change it]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>