CVE-2026-93990

Received Received - Intake

UTF-16 Surrogate Handling Flaw in Expat XML Parser

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: VulnCheck

Description

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-93990

Affected Vendors & Products

Vendor	Product	Version / Range
expat	expat	to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-176	The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

Executive Summary

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input. This allows malformed UTF-16 sequences to be accepted by the parser. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Expat (through 2.8.4) and testing XML parsers for UTF-16 handling issues. Use commands like 'expat -v' or 'dpkg -l | grep expat' to check installed versions. Test with crafted UTF-16 XML inputs to observe parser behavior.

Impact Analysis

This vulnerability can allow attackers to inject malicious XML content into applications using Expat. This could lead to data corruption, unauthorized access, or other security breaches depending on how the XML is processed by the affected system.

Mitigation Strategies

Immediately update Expat to version 2.8.5 or later. If updating is not possible, disable XML parsing for untrusted inputs or implement strict input validation. Monitor vendor advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-93990. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70