Log in Start free

Vulnerability · Published Sep 19, 2026 · Assigned by VulnCheck

CVE-2026-93990Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

High 7.5

In plain English

A high-severity security flaw in libexpat from libexpat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 65.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10expat2.7.3-1.el10_2.5ALSA-2026:74001
AlmaLinux:8expat2.5.0-4.el8_10ALSA-2026:72448
AlmaLinux:9expat2.5.0-6.el9_8.5ALSA-2026:72663
AlmaLinux:10expat-devel2.7.3-1.el10_2.5ALSA-2026:74001
AlmaLinux:8expat-devel2.5.0-4.el8_10ALSA-2026:72448
AlmaLinux:9expat-devel2.5.0-6.el9_8.5ALSA-2026:72663
Alpine:v3.21expat2.8.5-r0ALPINE-CVE-2026-93990
Alpine:v3.22expat2.8.5-r0ALPINE-CVE-2026-93990
Alpine:v3.23expat2.8.5-r0ALPINE-CVE-2026-93990
Alpine:v3.24expat2.8.5-r0ALPINE-CVE-2026-93990
Debian:12expat2.5.0-1+deb12u4DEBIAN-CVE-2026-93990
Debian:13expat2.9.0-1~deb13u1DEBIAN-CVE-2026-93990
Debian:14expat2.8.4-2DEBIAN-CVE-2026-93990
Rocky Linux:10expat0:2.7.3-1.el10_2.5RLSA-2026:74001
Rocky Linux:8expat0:2.5.0-4.el8_10RLSA-2026:72448
Rocky Linux:9expat0:2.5.0-6.el9_8.5RLSA-2026:72663
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2026-93990
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2026-93990
Ubuntu:22.04:LTSexpatno fix listedUBUNTU-CVE-2026-93990
Ubuntu:24.04:LTSexpatno fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.04:LTSexpatno fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.10expatno fix listedUBUNTU-CVE-2026-93990
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2026-93990
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2026-93990
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2026-93990
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2026-93990
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2026-93990
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-93990
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2026-93990
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2026-93990

Affected products (as reported)

VendorProductVersions
libexpat libexpat 0 – before 2.8.5

Weakness: CWE-176 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References