CVE-2026-93990: Expat through 2.8.4 Malformed UTF-16 Acceptance via Unchecked Surrogate
Published Sep 19, 2026
·Updated
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
Affected Software
1 affected component
Expat<=2.8.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
expatto a version that resolves this vulnerability.Fixed in 2.8.4
Event History
Sep 19, 2026
CVE Published
via MITRE·10:58 PM
Data Sourced
via MITRE·10:58 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which Expat versions are affected?
Expat versions through 2.8.4 are affected.
2
What input must an attacker control to exploit this issue?
An attacker needs to supply crafted UTF-16 encoded XML containing lone high surrogates. The malformed sequence can consume subsequent code units and conceal markup characters from the parser.