CVE-2026-93990 — Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supp…
Published: 2026-09-19 · CVSS: 8.7 · CVSS 4.0
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7