{"id":"CLSA-2026-1788864771","summary":"Fix CVE(s): CVE-2026-72522, CVE-2026-76957","details":"   * SECURITY UPDATE: out-of-bounds read and infinite loop in the *_toUtf16\n     converters used by the -DXML_UNICODE build (libexpatw)\n     - debian/patches/CVE-2026-72522.patch: only treat a trailing high\n       surrogate (0xD800-0xDBFF) as a split surrogate pair in\n       DEFINE_UTF16_TO_UTF16(), masking with 0xFC instead of 0xF8\n       (libexpat PR #1296).\n     - CVE-2026-72522\n   * SECURITY UPDATE: use-after-free through same-parser calls made from the\n     application's custom encoding callbacks\n     - debian/patches/CVE-2026-76957.patch: route the unknown-encoding\n       convert and release callbacks through the handler call depth\n       tracking so XML_Parse, XML_ParseBuffer, XML_GetBuffer, XML_ParserFree\n       and XML_ParserReset are rejected from inside them (libexpat PR #1322).\n     - CVE-2026-76957","modified":"2026-10-26T09:32:02.114668384Z","published":"2026-09-08T10:53:01Z","upstream":["CVE-2026-72522","CVE-2026-76957"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1788864771.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72522"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76957"}],"affected":[{"package":{"name":"expat","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/expat?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1788864771.json"}},{"package":{"name":"libexpat1","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libexpat1?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1788864771.json"}},{"package":{"name":"libexpat1-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/libexpat1-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els13"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1788864771.json"}}],"schema_version":"1.9.0"}