libexpat 2.8.5 fixes CVE-2026-93990 (malformed UTF-16 smuggling)

Expat (libexpat) through version 2.8.4 fails to validate that a high surrogate in UTF-16 input is followed by a valid low surrogate, so malformed UTF-16 sequences are silently accepted. A lone high surrogate consumes the following code unit, allowing an attacker to craft UTF-16-encoded XML in which markup characters are effectively hidden from the parser. This enables XML injection attacks: the consuming application can be made to interpret document structure or content differently than intended, which matches the CVSS 4.0 vector's high integrity impact with no confidentiality or availability impact. Any application, runtime, or product that embeds Expat and parses attacker-influenced UTF-16 XML is potentially affected, and the library's ubiquity makes that a very large population. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.