Expat XML Parser Vulnerability in Expat Library by Expat Developer
CVE-2026-93990

8.7HIGH

Key Information:

Vendor

Libexpat

Status
Libexpat
Vendor
CVE Published:
19 September 2026

What is CVE-2026-93990?

The Expat Library, up to version 2.8.4, does not adequately validate low surrogates following high surrogates in UTF-16 encoded input. This oversight allows attackers to craft malicious XML that includes lone high surrogates, which can manipulate the parser into accepting malformed UTF-16 sequences. As a result, markup characters can be hidden, potentially leading to XML injection attacks that could compromise application security.

Affected Version(s)

libexpat 0 <= 2.8.4

References

https://github.com/libexpat/libexpat/pull/1282
issue-trackingpatch
https://github.com/libexpat/libexpat/commit/ff6e1d7e750bb...
patch
https://github.com/libexpat/libexpat
product

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kartik Kenchi (netliomax25-code)
.