CVE-2026-93990Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-176

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
Peaked 2d ago at 3 mentions (2026-09-20); latest day: 1
5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d

Signal classification2 categories

Disclosure

480.0%

Patch

120.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-20	3	Disclosure3
2026-09-22	1	Disclosure1
2026-10-27	1	Patch1

Full discourse5 posts

Upwind Security MDR@UpwindMDR44d
Disclosure
🚨HIGH - Expat UTF-16 Surrogate Pair Validation Bypass Enables XML Injection (CVE-2026-93990) Expat’s UTF-16 decoder accepts lone high surrogates, letting malformed UTF-16 XML consume the next code unit and hide markup chars from the parser. Attackers can smuggle tags/entities past validation/sanitizers, enabling XML injection in downstream consumers. 👉Affected: libexpat <= 2.8.4
Post summary
The text discloses a high-severity Expat UTF-16 surrogate pair validation bypass enabling XML injection (CVE-2026-93990), affecting libexpat <= 2.8.4, with technical details but no PoC, exploit tool, patch, or active exploitation evidence.
0001080
310 followersView on X
Hugo | DevOps | Cybersecurity@HugoValters8d
Patch
CVE-2026-93990 in Expat (CVSS 7.5): malformed UTF-16 surrogates slip past validation, enabling XML injection. Fix is out, patch now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-93990/ #Expat #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The text announces CVE-2026-93990 for Expat, detailing a UTF-16 surrogate validation flaw enabling XML injection, and notes a fix is available to be applied immediately.
0000032
1.1K followersView on X
ADK Cyber@ADKCyber45d
Disclosure
Expat <=2.8.4 has UTF-16 surrogate validation issue (CVE-2026-93990, CVSS 8.7). Review XML dependencies for impact. https://nvd.nist.gov/vuln/detail/CVE-2026-93990 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/xNCemfgVxC
Post summary
The tweet announces CVE-2026-93990 affecting Expat versions up to 2.8.4, characterizing it as a UTF-16 surrogate validation issue with a CVSS of 8.7, and points to the NVD entry for further details.
0000033
97 followersView on X
CVE@CVEnew45d
Disclosure
CVE-2026-93990 Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craf… https://www.cve.org/CVERecord?id=CVE-2026-93990
Post summary
The text reports CVE-2026-93990 in Expat < 2.8.4, detailing a UTF-16 surrogate validation flaw that could accept malformed sequences, but contains no PoC, exploit tool, active exploitation claims, or patch/remediation information.
00000962
58.1K followersView on X
Severity Daily@severitydaily46d
Disclosure
Expat's new UTF-16 flaw is fixed on master and in no release, so every version you can install is affected. VulnCheck (@VulnCheckAI) scores it 8.7. No exploitation reported. https://severitydaily.com/expat-cve-2026-93990-utf16-surrogate-8-7-no-released-fix-master-only/
Post summary
The text discloses a new Expat UTF-16 vulnerability with a CVSS score of 8.7, notes it is fixed only on master, and states no exploitation has been reported.
0000051
24 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-93990

Upwind Security MDR[verified]@UpwindMDRDisclosure

The text discloses a high-severity Expat UTF-16 surrogate pair validation bypass enabling XML injection (CVE-2026-93990), affecting libexpat <= 2.8.4, with technical details but no PoC, exploit tool, patch, or active exploitation evidence.

Hugo | DevOps | Cybersecurity[verified]@HugoValtersPatch

The text announces CVE-2026-93990 for Expat, detailing a UTF-16 surrogate validation flaw enabling XML injection, and notes a fix is available to be applied immediately.

ADK Cyber[verified]@ADKCyberDisclosure

The tweet announces CVE-2026-93990 affecting Expat versions up to 2.8.4, characterizing it as a UTF-16 surrogate validation issue with a CVSS of 8.7, and points to the NVD entry for further details.

Severity Daily[verified]@severitydailyDisclosure

The text discloses a new Expat UTF-16 vulnerability with a CVSS score of 8.7, notes it is fixed only on master, and states no exploitation has been reported.

CVE@CVEnewDisclosure

The text reports CVE-2026-93990 in Expat < 2.8.4, detailing a UTF-16 surrogate validation flaw that could accept malformed sequences, but contains no PoC, exploit tool, active exploitation claims, or patch/remediation information.