CVE-2026-93990
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Sep 19, 2026
CISA due date
—
The record
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
- CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
- CVE-2026-14978 HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass… CWE-176
- CVE-2026-59890 setuptools is a package that allows users to download, build, install, upgrade, and… CWE-176
- CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling… CWE-176
- CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-176
- CVE-2026-45135 Caddy is an extensible server platform that uses TLS by default. CWE-176
- GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) CWE-176