CVE-2026-93990

A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enable XML injection attacks, potentially leading to information disclosure or other integrity impacts.

This is an Important flaw in Expat, which can lead to XML injection. The vulnerability arises from improper validation of UTF-16 surrogate pairs, allowing attackers to craft malformed XML that can bypass parser security checks. This could result in data integrity compromise in applications processing untrusted XML input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this restrict which hosts can send XML (including UTF-16) to Expat-based services with a host firewall and network segmentation. Where applications allow, prefer UTF-8-only input and reject unexpected encodings.