libexpat 2.8.5 fixes CVE-2026-93990 (malformed UTF-16 smuggling)
libexpat 2.8.5 fixes CVE-2026-93990 by rejecting malformed UTF-16 that could be smuggled into applications.
Sebastian Pipping announced that libexpat 2.8.5, also called Expat 2.8.5, fixes CVE-2026-93990. The release rejects high UTF-16 surrogates that are not followed by a low surrogate. Previously, malformed UTF-16 could be passed into applications using Expat, where the application's handling could cause arbitrary damage. The note does not report observed exploitation.
- libexpat 2.8.5, also called Expat 2.8.5, shipped today.
- CVE-2026-93990: unpaired high UTF-16 surrogates were accepted.
- Malformed UTF-16 could reach the application and cause damage.
- Announcement does not report in-the-wild exploitation.
- CVEs
- CVE-2026-93990
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93990 | UTF-16 Surrogate Validation Flaw Enables XML Injection in Expat through 2.8.4 | 8.7 | — |
From the original article
Posted by Sebastian Pipping on Sep 22 Hello oss-security, just a quick note that libexpat 2. 8. 5 (or "Expat 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.