CVE-2026-93990

Awaiting Analysis Awaiting Analysis - Queue

UTF-16 Surrogate Handling Flaw in Expat XML Parser

Publication date: 2026-09-19

Last updated on: 2026-09-28

Assigner: VulnCheck

Description

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-28

Generated

2026-10-10

AI Q&A

2026-09-20

EPSS Evaluated

2026-10-09

NVD

CVE-2026-93990

Affected Vendors & Products

Vendor	Product	Version / Range
expat	expat	to 2.8.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-176	The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

Executive Summary

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input. This allows malformed UTF-16 sequences to be accepted by the parser. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Expat (through 2.8.4) and testing XML parsers for UTF-16 handling issues. Use commands like 'expat -v' or 'dpkg -l | grep expat' to check installed versions. Test with crafted UTF-16 XML inputs to observe parser behavior.

Impact Analysis

This vulnerability can allow attackers to inject malicious XML content into applications using Expat. This could lead to data corruption, unauthorized access, or other security breaches depending on how the XML is processed by the affected system.

Compliance Impact

This vulnerability enables XML injection attacks by bypassing parser validation of malformed UTF-16 sequences. Such attacks could allow unauthorized data access, modification, or exfiltration, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update Expat to version 2.8.5 or later. If updating is not possible, disable XML parsing for untrusted inputs or implement strict input validation. Monitor vendor advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-93990. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70