CVE-Katalog

CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML c

[CVE-Katalog]

Schweregrad
High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.40% · Oct 22, 2026

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexpatsid2.9.0-1fixed
Debianexpatforky2.9.0-1fixed
Debianexpattrixie2.8.3-1~deb13u1vulnerable
Debianexpattrixie-security2.9.0-1~deb13u1fixed
Debianexpatbookworm2.5.0-1+deb12u2vulnerable
Debianexpatbookworm-security2.5.0-1+deb12u5fixed
Alpineexpat3.212.8.5-r0fixed
Alpineexpat3.222.8.5-r0fixed
Alpineexpat3.232.8.5-r0fixed
Alpineexpat3.242.8.5-r0fixed
Ubuntucoin3pro3.1.4~abc9f50+dfsg1-2vulnerable
Ubuntucoin3pro3.1.4~abc9f50+dfsg2-1vulnerable
Ubuntucoin3pro3.1.4~abc9f50+dfsg3-1vulnerable
Ubuntucoin3pro3.1.4~abc9f50+dfsg3-2vulnerable
Ubuntucoin3pro3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1vulnerable
Ubuntuexpatpro2.2.7-2vulnerable
Ubuntuexpatpro2.2.9-1vulnerable
Ubuntuexpatpro2.2.9-1build1vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.2vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.4vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.5vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.6vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.7vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.8vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.8+esm1vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.8+esm2vulnerable
Ubuntuexpatpro2.2.9-1ubuntu0.8+esm3vulnerable
Ubuntuvnc4pro4.1.1+xorg4.3.0-37.3ubuntu2vulnerable
Ubuntuvnc4pro4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1vulnerable
Ubuntuvtkpro5.10.1+dfsg-2vulnerable
Ubuntuvtkpro5.10.1+dfsg-2build3vulnerable
Ubuntuvtkpro5.10.1+dfsg-2.1build1vulnerable
Ubuntuvtkpro5.10.1+dfsg-2.1ubuntu0.1~esm1vulnerable
Ubuntuxmlrpc-cpro1.33.14-11vulnerable
Ubuntuxmlrpc-cpro1.33.14-11.1vulnerable
Ubuntuxmlrpc-cpro1.33.14-12vulnerable
Ubuntuxmlrpc-cpro1.33.14-12build1vulnerable
Ubuntuxmlrpc-cpro1.33.14-12build2vulnerable
Ubuntuxmlrpc-cpro1.33.14-12ubuntu0.1~esm1vulnerable
Ubuntuayttmpro0.6.3-3build1vulnerable
Ubuntuayttmpro0.6.3-3ubuntu0.1~esm1vulnerable
Ubuntucableswigpro0.1.0+git20150808-1vulnerable
Ubuntucableswigpro0.1.0+git20150808-2vulnerable
Ubuntucableswigpro0.1.0+git20150808-2ubuntu0.1~esm1vulnerable
Ubuntucadaver16.040.23.3-2ubuntu2vulnerable
Ubuntugdcm16.042.4.4-4vulnerable
Ubuntugdcm16.042.4.4-4build1vulnerable
Ubuntugdcm16.042.4.4-4ubuntu1vulnerable
Ubuntugdcm16.042.6.1-3vulnerable
Ubuntugdcm16.042.6.2-1vulnerable
Ubuntugdcm16.042.6.2-2vulnerable
Ubuntugdcm16.042.6.2-3vulnerable
Ubuntugdcm16.042.6.3-1vulnerable
Ubuntugdcm16.042.6.3-1ubuntu1vulnerable
Ubuntugdcm16.042.6.3-2ubuntu1vulnerable
Ubuntugdcm16.042.6.3-3ubuntu1vulnerable
Ubuntugdcm16.042.6.3-3ubuntu3vulnerable
Ubuntuinsighttoolkit416.044.8.1-1ubuntu3vulnerable
Ubuntuinsighttoolkit416.044.8.1-1ubuntu4vulnerable
Ubuntuinsighttoolkit416.044.8.2-3.1ubuntu1vulnerable
Ubuntuinsighttoolkit416.044.9.0-3ubuntu2vulnerable
Ubuntuinsighttoolkit416.044.9.0-4ubuntu1vulnerable
Ubuntuinsighttoolkit416.044.9.0-4ubuntu1.1vulnerable
Ubuntulibxmltokpro1.2-4ubuntu1vulnerable
Ubuntulibxmltokpro1.2-4.1ubuntu1vulnerable
Ubuntulibxmltokpro1.2-4.1ubuntu2vulnerable
Ubuntulibxmltokpro1.2-4.1ubuntu2.24.0.4.1+esm1vulnerable
Ubuntulibxmltokpro1.2-4.1ubuntu2.24.0.4.1+esm2vulnerable
Ubuntulibxmltokpro1.2-4.1ubuntu2.24.0.4.1+esm3vulnerable
Ubuntulibxmltokpro1.2-4.1ubuntu2.24.0.4.1+esm4vulnerable
Ubuntulibxmltokpro1.2-4.1ubuntu2.24.0.4.1+esm5vulnerable
Ubuntumatanza16.040.13+ds1-5vulnerable
Ubuntusmart16.041.4-2vulnerable
Ubuntuswish-epro2.4.7-7vulnerable
Ubuntuswish-epro2.4.7-7.1vulnerable
Ubuntuswish-epro2.4.7-7.1ubuntu0.1~esm1vulnerable
Ubuntutdom16.040.8.3-1vulnerable
Ubuntuwbxml216.040.10.7-1vulnerable
Ubuntucadaver18.040.23.3-2ubuntu3vulnerable
Ubuntugdcm18.042.8.2-3build1vulnerable
Ubuntugdcm18.042.8.3-1vulnerable
Ubuntugdcm18.042.8.4-1vulnerable
Ubuntugdcm18.042.8.4-1build2vulnerable
Ubuntuinsighttoolkit418.044.12.2-dfsg1-1ubuntu1vulnerable
Ubuntumatanza18.040.13+ds1-5build1vulnerable
Ubuntumatanza18.040.13+ds1-6vulnerable
Ubuntusmart18.041.4-2vulnerable
Ubuntutdom18.040.8.3-1vulnerable
Ubuntutdom18.040.9.0-1vulnerable
Ubuntuvnc418.044.1.1+xorg4.3.0-37.3ubuntu2vulnerable
Ubuntuwbxml218.040.10.7-1vulnerable
Ubuntuwbxml218.040.10.7-1build1vulnerable
Ubuntucadaver20.040.23.3-2.1build1vulnerable
Ubuntuinsighttoolkit420.044.12.2-dfsg1-4.1ubuntu1vulnerable
Ubuntuinsighttoolkit420.044.13.2-dfsg1-1ubuntu1vulnerable
Ubuntuinsighttoolkit420.044.13.2-dfsg1-4ubuntu1vulnerable
Ubuntuinsighttoolkit420.044.13.2-dfsg1-6vulnerable
Ubuntuinsighttoolkit420.044.13.2-dfsg1-6ubuntu1vulnerable
Ubuntuinsighttoolkit420.044.13.2-dfsg1-8vulnerable
Ubuntumatanza20.040.13+ds1-6vulnerable
Ubuntumatanza20.040.13+ds2-1vulnerable
Ubuntutdom20.040.9.1-1vulnerable
Ubuntuwbxml220.040.10.7-1build1vulnerable
Ubuntucadaver22.040.23.3-2.1build1vulnerable
Ubuntuexpat22.042.4.1-2vulnerable
Ubuntuexpat22.042.4.1-3vulnerable
Ubuntuexpat22.042.4.2-1vulnerable
Ubuntuexpat22.042.4.3-1vulnerable
Ubuntuexpat22.042.4.3-2vulnerable
Ubuntuexpat22.042.4.4-1vulnerable
Ubuntuexpat22.042.4.6-1vulnerable
Ubuntuexpat22.042.4.7-1vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.1vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.2vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.3vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.4vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.5vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.6vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.7vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.8vulnerable
Ubuntuexpat22.042.4.7-1ubuntu0.9vulnerable
Ubuntuinsighttoolkit422.044.13.3withdata-dfsg1-4.1vulnerable
Ubuntuinsighttoolkit422.044.13.3withdata-dfsg2-1ubuntu1vulnerable
Ubuntumatanza22.040.13+ds2-1vulnerable
Ubuntutdom22.040.9.2-1vulnerable
Ubuntuwbxml222.040.10.7-1build1vulnerable
Ubuntuwbxml222.040.11.7+dfsg-1vulnerable
Ubuntucadaver24.040.24+dfsg-2vulnerable
Ubuntucadaver24.040.24+dfsg-3vulnerable
Ubuntucadaver24.040.24+dfsg-3build1vulnerable
Ubuntucadaver24.040.24+dfsg-3build2vulnerable
Ubuntuexpat24.042.5.0-2vulnerable
Ubuntuexpat24.042.6.0-1vulnerable
Ubuntuexpat24.042.6.1-2vulnerable
Ubuntuexpat24.042.6.1-2build1vulnerable
Ubuntuexpat24.042.6.1-2ubuntu0.1vulnerable
Ubuntuexpat24.042.6.1-2ubuntu0.2vulnerable
Ubuntuexpat24.042.6.1-2ubuntu0.3vulnerable
Ubuntuexpat24.042.6.1-2ubuntu0.4vulnerable
Ubuntuexpat24.042.6.1-2ubuntu0.5vulnerable
Ubuntuexpat24.042.6.1-2ubuntu0.6vulnerable
Ubuntumatanza24.040.13+ds2-1vulnerable
Ubuntumatanza24.040.13+ds2-1build1vulnerable
Ubuntumatanza24.040.13+ds2-1build2vulnerable
Ubuntutdom24.040.9.3-1vulnerable
Ubuntutdom24.040.9.3-1build1vulnerable
Ubuntuwbxml224.040.11.8+dfsg-3vulnerable
Ubuntuwbxml224.040.11.8+dfsg-3build1vulnerable
Ubuntucadaver26.100.28+dfsg-2vulnerable
Ubuntuexpat26.102.7.4-1vulnerable
Ubuntuexpat26.102.8.1-1vulnerable
Ubuntuexpat26.102.8.2-1vulnerable
Ubuntuexpat26.102.8.3-1vulnerable
Ubuntuexpat26.102.8.3-1ubuntu1vulnerable
Ubuntumatanza26.100.13+ds2-2build1vulnerable
Ubuntuswish-e26.102.4.7-7.1vulnerable
Ubuntuswish-e26.102.4.7-7.2vulnerable
Ubuntuswish-e26.102.4.7-7.2build1vulnerable
Ubuntutdom26.100.9.6-2vulnerable
Ubuntutdom26.100.9.6-3vulnerable
Ubuntuwbxml226.100.11.10+dfsg-3vulnerable
Ubuntuwbxml226.100.11.10+dfsg-4vulnerable
Ubuntuxmlrpc-c26.101.60.05-1vulnerable
Ubuntuxmlrpc-c26.101.60.05-1build1vulnerable
Ubuntucadaver26.040.26+dfsg-2vulnerable
Ubuntucadaver26.040.28+dfsg-1vulnerable
Ubuntucadaver26.040.28+dfsg-2vulnerable
Ubuntuexpat26.042.7.1-2vulnerable
Ubuntuexpat26.042.7.3-1vulnerable
Ubuntuexpat26.042.7.4-1vulnerable
Ubuntuexpat26.042.7.4-1ubuntu0.1vulnerable
Ubuntuexpat26.042.7.4-1ubuntu0.2vulnerable
Ubuntumatanza26.040.13+ds2-2vulnerable
Ubuntumatanza26.040.13+ds2-2build1vulnerable
Ubuntutdom26.040.9.5.1-3vulnerable
Ubuntutdom26.040.9.6-2vulnerable
Ubuntuwbxml226.040.11.10+dfsg-2vulnerable
Ubuntuwbxml226.040.11.10+dfsg-2build1vulnerable
Ubuntuwbxml226.040.11.10+dfsg-3vulnerable
Ubuntuxmlrpc-c26.041.59.03-10.1vulnerable
Ubuntuxmlrpc-c26.041.60.05-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexpatsourcesid2.8.4-2not yet assignedNot reported[1148665]
Debianexpatsourceforky2.8.4-2not yet assignedNot reported[1148665]
Debianexpatsourcetrixie2.9.0-1~deb13u1not yet assignedNot reported[1148665]
Debianexpatsourcebookworm2.5.0-1+deb12u4not yet assignedNot reported[1148665]
Alpineexpatapk3.212.8.5-r0Not reportedALPINE-CVE-2026-93990Not reported
Alpineexpatapk3.222.8.5-r0Not reportedALPINE-CVE-2026-93990Not reported
Alpineexpatapk3.232.8.5-r0Not reportedALPINE-CVE-2026-93990Not reported
Alpineexpatapk3.242.8.5-r0Not reportedALPINE-CVE-2026-93990Not reported

[Debian bug #1148665]

OpenFactory catalog packages

Die Paketzuordnung läuft.

[Debian 12 (Bookworm)]

  • [expat]Unbekannt
    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

  • [libexpat1]Unbekannt

    Quellpaket: [expat]

    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

  • [libexpat1-dev]Unbekannt

    Quellpaket: [expat]

    Details (4)

    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Betroffen · Behoben: 2.5.0-1+deb12u4

      nvd · expat · debian · bookworm

Beobachtet:

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]