CVE-2026-93990 Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
Attackers can inject malformed UTF-16 sequences into XML, causing data corruption or silent character replacement in applications using the Expat library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93990?
CVE-2026-93990 is a high-severity vulnerability in libexpat, published on 19 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Weakness: CWE-176
Which versions are affected by CVE-2026-93990?
Linux distribution packages (3)
expat Red Hat:hummingbird:1 | All versions | 0:2.8.4-0.2.hum1 |
expat-devel Red Hat:hummingbird:1 | All versions | 0:2.8.4-0.2.hum1 |
expat-static Red Hat:hummingbird:1 | All versions | 0:2.8.4-0.2.hum1 |
How do I fix CVE-2026-93990?
Upgrade to a fixed version.
Is CVE-2026-93990 being exploited?
There is no known exploitation of CVE-2026-93990 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-93990, AZL-103316, AZL-105099, AZL-105149, AZL-105260, BELL-CVE-2026-93990 and 16 more.