https://seclists.org/oss-sec/2026/q3/863: libexpat 2.8.5 fixes CVE-2026-93990 (malformed UTF-16 smuggling)

Q: What kind of input is needed to trigger the issue?

An attacker needs to supply malformed UTF-16 containing a high surrogate that is not followed by a low surrogate. The malformed data could previously pass through Expat and reach the application.

Q: Does exploitation require authentication or user interaction?

The upstream CVSS 3.1 vector lists network attack access, low complexity, no privileges required, and no user interaction. Its stated impact is high for confidentiality, integrity, and availability.

Q: Why does the impact depend on the application using Expat?

Expat could smuggle malformed UTF-16 into the application, and the resulting damage depended on how that application handled malformed UTF-16. The release notes state that this validation should have been performed by Expat rather than left to the application.

Published Sep 22, 2026

Updated

Affected Software

1 affected component

Expat Expat<2.8.5

Frequently Asked Questions

What kind of input is needed to trigger the issue?

An attacker needs to supply malformed UTF-16 containing a high surrogate that is not followed by a low surrogate. The malformed data could previously pass through Expat and reach the application.

Does exploitation require authentication or user interaction?

The upstream CVSS 3.1 vector lists network attack access, low complexity, no privileges required, and no user interaction. Its stated impact is high for confidentiality, integrity, and availability.

Why does the impact depend on the application using Expat?

Expat could smuggle malformed UTF-16 into the application, and the resulting damage depended on how that application handled malformed UTF-16. The release notes state that this validation should have been performed by Expat rather than left to the application.