Vulnerability in Libexpat
CVE-2026-93990
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking, patch)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-93990?
- CVE-2026-93990 is a high-severity vulnerability in Libexpat, classified under CWE-176. CVSS score: 7.5/10. Published 2026-09-19.
- How severe is CVE-2026-93990?
- High severity. CVSS v3 base score is 7.5 out of 10.