FreeBSD stables now ship Expat 2.8.3
Brief
The vendor says the hang needs a 16-bit-character build, and the FreeBSD config in this import does not turn that on.
Notes
330b8d685e585e1c6aa41106dd66a7e4256f2068 on stable/15. 465c0e484458a2896fb7c28780f2cf73ea79f8ce on stable/14. Same Security: CVE-2026-72522. No FreeBSD-SA.
Vendor Changes: out-of-bounds read and infinite loop when low Unicode surrogates are treated as high during UTF-16 conversion. Gate is a 16-bit-character build.
This import does not define XML_UNICODE or XML_UNICODE_WCHAR_T. Not on releng/15.1, 15.0, 14.4, or 14.5.
Unknown: whether an SA will follow; whether some other FreeBSD consumer rebuilds contrib/expat with 16-bit characters.
Commit 330b8d685e585e1c6aa41106dd66a7e4256f2068; 465c0e484458a2896fb7c28780f2cf73ea79f8ce