Description
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Published: 2026-09-19
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unpaired Surrogate Acceptance
Action: Patch Now
AI Analysis

Impact

Expat, prior to version 2.8.5, does not verify that a high surrogate in UTF‑16 input is followed by a low surrogate, allowing XML documents containing lone high surrogate code units to be parsed successfully. These malformed UTF‑16 sequences are passed through by the library to applications compiled with XML_UNICODE or are silently replaced in other builds, leading to corruption or unexpected alteration of XML content.

Affected Systems

The libexpat XML parsing library, versions up to and including 2.8.4, is affected. Any software that links against these releases—regardless of the operating system—may be vulnerable.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, while the EPSS of less than 1% indicates a very low but nonzero chance of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The typical attack vector is a remote client that submits a crafted UTF‑16 XML document to a service using libexpat.

Generated by OpenCVE AI on September 28, 2026 at 18:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libexpat to version 2.8.5 or later, which contains the surrogate pair validation fix.
  • If an immediate upgrade is not feasible, apply the patch from commit ff6e1d7e directly to the source repository.
  • Validate or sanitize all external XML input for proper UTF‑16 encoding to ensure a low surrogate follows any high surrogate before passing it to libexpat.

Generated by OpenCVE AI on September 28, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4807-1 expat security update
History

Mon, 28 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks. Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Title Expat through 2.8.4 Malformed UTF-16 Acceptance via Unchecked Surrogate Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
References

Wed, 23 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-91
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 21 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 20 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Libexpat
Libexpat expat
Vendors & Products Libexpat
Libexpat expat

Sat, 19 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Description Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
Title Expat through 2.8.4 Malformed UTF-16 Acceptance via Unchecked Surrogate
First Time appeared Libexpat Project
Libexpat Project libexpat
Weaknesses CWE-176
CPEs cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
Vendors & Products Libexpat Project
Libexpat Project libexpat
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Libexpat Expat
Libexpat Project Libexpat
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-28T16:11:06.770Z

Reserved: 2026-09-19T10:55:49.093Z

Link: CVE-2026-93990

cve-icon Vulnrichment

Updated: 2026-09-21T15:11:05.367Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-19T23:17:10.203

Modified: 2026-09-28T17:17:53.037

Link: CVE-2026-93990

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-19T22:58:11Z

Links: CVE-2026-93990 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T18:15:04Z

Weaknesses
  • CWE-176

    Improper Handling of Unicode Encoding

  • CWE-91

    XML Injection (aka Blind XPath Injection)