CVE-2026-93990

Expat (libexpat) through version 2.8.4 fails to validate that a high surrogate in UTF-16 input is followed by a valid low surrogate, so malformed UTF-16 sequences are silently accepted. A lone high surrogate consumes the following code unit, allowing an attacker to craft UTF-16-encoded XML in which markup characters are effectively hidden from the parser. This enables XML injection attacks: the consuming application can be made to interpret document structure or content differently than intended, which matches the CVSS 4.0 vector's high integrity impact with no confidentiality or availability impact. Any application, runtime, or product that embeds Expat and parses attacker-influenced UTF-16 XML is potentially affected, and the library's ubiquity makes that a very large population. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Monitor the Expat project for a patched release newer than 2.8.4 and update all copies of the library as soon as a fix ships, including OS packages (e.g., via apt/yum), Python's pyexpat, and any statically linked or bundled copies found via SBOM or dependency scans. Until patched, reject, normalize to UTF-8, or strictly validate UTF-16-encoded XML from untrusted sources before parsing. Note that the parsing flaw is pre-authentication and network-reachable wherever untrusted XML in UTF-16 form is accepted, per the CVSS vector.