CVE-2026-93990: Libexpat

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Affected products

• Libexpat Libexpat: before 2.8.5 (fixed in 2.8.5)

Published 2026-09-19. Last modified 2026-09-28.