Skip to main content

libexpat (Expat) CVE-2026-93990

| EUVDEUVD-2026-83618 HIGH
Improper Handling of Unicode Encoding (CWE-176)
2026-09-19 VulnCheck GHSA-rfp9-ffqc-h4x8
Code Injection Red Hat Libexpat Suse Xml
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable, unauthenticated malformed UTF-16 XML yields markup smuggling/injection: integrity-only (I:H), with no confidentiality or availability impact and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
POC Analysis Generated
Sep 20, 2026 - 11:20 vuln.today
Metadata Corrected
Sep 19, 2026 - 23:40 vuln.today
tag: Xml added
Analysis Generated
Sep 19, 2026 - 23:32 vuln.today
CVE Published
Sep 19, 2026 - 22:58 cve.org
HIGH 8.7

DescriptionCVE.org

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

AnalysisAI

Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high surrogate paired with the following code unit is accepted as a valid surrogate pair, so a character such as '<' is consumed as part of the pair and never tokenized. Only applications that parse UTF-16-encoded XML (little- or big-endian) from an untrusted source are affected - the dominant UTF-8 input path is not exploitable - and meaningful integrity impact additionally requires a downstream filter, sanitizer, or validator that trusts the parsed structure and therefore sees different markup than Expat exposes. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the application to parse UTF-16-encoded XML (little- or big-endian) from an untrusted source using Expat through 2.8.4; the default and dominant UTF-8 input path is not affected, so applications that only accept UTF-8 are not exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are mixed and point to a real-but-conditional integrity flaw rather than a mass-exploitation emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the upstream fix: patch to the Expat revision containing PR #1282 / commit ff6e1d7e750bbe245178f51a47a965dc8342861a, which adds strict high-surrogate/low-surrogate validation in both the UTF-16LE and UTF-16BE tokenizers (legacy note: patch status is 'Available from vendor' via GitHub, so a tagged release version beyond 2.8.4 is not independently confirmed here - track the libexpat release notes before asserting a fixed version string). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all applications, appliances, and third-party components that embed libexpat at version 2.8.4 or earlier and determine which of them accept UTF-16 encoded XML (little- or big-endian) from untrusted external sources; treat only those as exposed, and as an immediate stopgap block or transcode inbound UTF-16 XML to UTF-8 at the perimeter or API gateway where feasible. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libexpat

View all
CVE-2022-25315 CRITICAL POC
9.8 Feb 18

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Rated critical severity (CVSS 9.8),
CVE-2017-9233 HIGH POC
7.5 Jul 25

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the p
CVE-2025-59375 HIGH POC
7.5 Sep 15

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is
CVE-2026-45186 HIGH POC
7.5 May 10

Denial of service in libexpat before 2.8.1 lets remote attackers exhaust CPU by submitting moderately sized crafted XML

CVE-2022-43680 HIGH POC
7.5 Oct 24

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnti
CVE-2019-15903 HIGH POC
7.5 Sep 04

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too
CVE-2013-0340 MEDIUM POC
6.8 Jan 21

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetE
CVE-2016-0718 CRITICAL
9.8 May 26

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a m
CVE-2024-45492 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2024-45491 CRITICAL
9.8 Aug 30

An issue was discovered in libexpat before 2.6.3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2026-66046 HIGH
8.7 Aug 18

Denial of service in libexpat through 2.8.3 stems from quadratic CPU complexity in the storeAtts() XML attribute process
CVE-2026-76641 HIGH
8.7 Aug 20

Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parse

Same weakness CWE-176 – Improper Handling of Unicode Encoding

View all
CVE-2025-71316 CRITICAL POC
9.2
CVE-2026-25480 MEDIUM POC
6.5
CVE-2026-23950 MEDIUM POC
5.9
CVE-2024-24691 CRITICAL
9.8
CVE-2023-39213 CRITICAL
9.8
CVE-2025-55129 MEDIUM POC
5.4
CVE-2023-41889 MEDIUM POC
5.3
CVE-2026-81869 MEDIUM POC
5.1

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected

Share

CVE-2026-93990 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy