CVE-2026-93990

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-93990
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93990.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-93990
Downstream
ALPINE (1)
AZL (4)
BELL (1)
DEBIAN (1)
ECHO (1)
OESA (4)
openSUSE (1)
RHSA (4)
RLSA (3)
ROOT (2)
SUSE (4)
UBUNTU (1)
Related
ALSA (3)
openSUSE (1)
SUSE (4)
Published
2026-09-19T22:58:11Z
Modified
2026-10-20T10:56:44Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
Details

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-176"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93990.json"
}
References

Affected packages

Git / github.com/libexpat/libexpat

Affected ranges

Type
GIT
Repo
https://github.com/libexpat/libexpat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b3f0b06f39fb5529cead381694f8929901bc273
Fixed
ff6e1d7e750bbe245178f51a47a965dc8342861a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.8.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "ff6e1d7e750bbe245178f51a47a965dc8342861a"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "R_2_8_5",
            "range":  [
                {
                    "fixed":  "4b3f0b06f39fb5529cead381694f8929901bc273"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other
REC1_0
R_1_95_0
R_1_95_2
R_1_95_3
R_1_95_4
R_1_95_5
R_1_95_6
R_1_95_7
R_1_95_8
R_2_0_0
R_2_0_1
R_2_1_0
R_2_1_1
R_2_2_0
R_2_2_1
R_2_2_10
R_2_2_2
R_2_2_3
R_2_2_4
R_2_2_5
R_2_2_6
R_2_2_7
R_2_2_8
R_2_2_9
R_2_3_0
R_2_4_0
R_2_4_1
R_2_4_2
R_2_4_3
R_2_4_4
R_2_4_5
R_2_4_6
R_2_4_7
R_2_4_8
R_2_4_9
R_2_5_0
R_2_6_0
R_2_6_1
R_2_6_2
R_2_6_3
R_2_6_4
R_2_7_0
R_2_7_1
R_2_7_2
R_2_7_3
R_2_7_4
R_2_7_5
R_2_8_0
R_2_8_1
R_2_8_2
R_2_8_3
R_2_8_4
V1990307
V19981122
V19981231
V19990109
V19990425
V19990626
V19990709
V19990728
V19991013
V1_0
V1_1
V20000512
beta2
beta3
beta4
jclark-orig
libexpat-alpha-1
sourceforge_init
start

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93990.json"