| Name | CVE-2026-93990 |
| Description | Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-4807-1, DSA-6566-1 |
| Debian Bugs | 1148665 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| expat (PTS) | bookworm | 2.5.0-1+deb12u2 | vulnerable |
| bookworm (security) | 2.5.0-1+deb12u4 | fixed | |
| trixie | 2.8.3-1~deb13u1 | vulnerable | |
| trixie (security) | 2.9.0-1~deb13u1 | fixed | |
| forky, sid | 2.9.0-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| expat | source | bookworm | 2.5.0-1+deb12u4 | DLA-4807-1 | ||
| expat | source | trixie | 2.9.0-1~deb13u1 | DSA-6566-1 | ||
| expat | source | (unstable) | 2.8.4-2 | 1148665 |
https://github.com/libexpat/libexpat/pull/1282
Fixed by: https://github.com/libexpat/libexpat/commit/0cfd15bdf4b2c22d6b0df73610709dfb60921091 (R_2_8_5)
Fixed by: https://github.com/libexpat/libexpat/commit/28fcfba540f6933aa8904a1514c4811713d2ab72 (R_2_8_5)