CVE-2026-93990
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Sep 19, 2026
Vendor
unknown
Description
Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.