CVE-2026-93990 in Expatinfo

Zusammenfassung

von MITRE • 20.09.2026

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

Once again VulDB remains the best source for vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Zuständig

VulnCheck

Reservieren

19.09.2026

Veröffentlichung

20.09.2026

Moderieren

akzeptiert

Eintrag

VDB-407988

CPE

bereit

EPSS

0.00000

KEV

nein

Aktivitäten

medium

Quellen

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-93990
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-93990
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-93990/

◂ ZurückÜbersichtWeiter ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!