CVE-2026-93990: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-93990 is an improper Unicode encoding handling vulnerability in the Expat (libexpat) XML parsing library affecting all versions through 2.8.4. The flaw allows malformed UTF-16 sequences — specifically lone high surrogates not followed by a valid low surrogate — to be silently accepted by the parser, enabling XML injection attacks. It was discovered by researcher Kartik Kenchi, reported via a GitHub pull request on June 23, 2026, and assigned CVE-2026-93990 on September 19, 2026, with a patch merged on September 18, 2026. The vulnerability carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-176 (Improper Handling of Unicode Encoding). In Expat's UTF-16 tokenizer, the IS_INVALID_CHAR macro was effectively a no-op for the little2 and big2 (UTF-16 LE/BE) encodings, meaning a high surrogate code unit (U+D800–U+DBFF) classified as a 4-byte lead character was never validated to be followed by a valid low surrogate (U+DC00–U+DFFF). Instead, the parser silently consumed the next code unit as a fake low surrogate, causing subsequent markup bytes (e.g., <) to be absorbed into character data and hidden from the parser. The fix adds real little2_isInvalid4 and big2_isInvalid4 validation functions that reject any high surrogate not followed by a valid low surrogate, mirroring the existing utf8_isInvalid4 logic. The security impact is most pronounced when Expat is compiled with XML_UNICODE defined, where malformed UTF-16 is passed through to the application rather than being translated to well-formed UTF-8 (libexpat PR #1282, Patch Commit).

Successful exploitation allows an unauthenticated, network-based attacker to inject unauthorized XML content by hiding markup characters from the Expat parser, bypassing XML-based security controls and input validation logic. The primary impact is a high integrity violation — attackers can manipulate the structure of parsed XML documents, potentially affecting downstream application logic, access controls, or data processing pipelines that rely on Expat for XML parsing. There is no direct confidentiality or availability impact, but the ability to smuggle malformed UTF-16 into applications (particularly those compiled with XML_UNICODE) could enable further exploitation depending on how the application processes the injected content. The vulnerability is analogous in class to CVE-2022-25235, which was previously leveraged for remote code execution in contexts such as Zoom via Expat (Github Advisory, libexpat PR #1282).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The researcher (Kartik Kenchi) confirmed a parser differential PoC — feeding {0xD800}X as UTF-16 causes following markup to be absorbed into character data — but did not demonstrate remote code execution. The EPSS score is 0.0, reflecting no current exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution is available.

1. Identify target: Locate an application that uses Expat (libexpat) version ≤ 2.8.4 to parse UTF-16 encoded XML input, particularly one compiled with the XML_UNICODE macro defined, which passes malformed UTF-16 directly to the application.
2. Craft malformed UTF-16 XML: Construct a UTF-16 encoded XML document containing a lone high surrogate (e.g., 0xD800) not followed by a valid low surrogate (U+DC00–U+DFFF). The high surrogate will be treated as a 4-byte lead character and will consume the next code unit as a fake low surrogate.
3. Embed hidden markup: Place a markup character (e.g., <) immediately after the lone high surrogate in the byte stream. Because the high surrogate consumes the next code unit, the < byte is absorbed into character data and hidden from the parser's tokenizer.
4. Submit to target: Send the crafted UTF-16 XML payload to the target application via any network interface that accepts XML input (e.g., HTTP API, XML-RPC endpoint, SOAP service).
5. Achieve XML injection: The parser fails to see the injected markup, allowing the attacker to manipulate the logical structure of the parsed XML document, potentially bypassing XML-based access controls, injecting unauthorized XML elements, or corrupting application data (libexpat PR #1282).

The fix is included in the Expat 2.8.5 milestone, with the patch merged to the master branch on September 18, 2026 (commit ff6e1d7). Users should upgrade libexpat to a version greater than 2.8.4 as soon as the 2.8.5 release is available (Patch Commit, Github Advisory). If immediate patching is not possible, implement strict UTF-16 input validation that rejects malformed surrogate sequences before passing data to Expat, and audit XML processing pipelines to ensure encoding validation occurs upstream of the parser. Applications compiled without XML_UNICODE have reduced exposure, as malformed UTF-16 is translated to well-formed UTF-8 in that build configuration rather than being passed through to the application.

Expat maintainer Sebastian Pipping (hartwork) noted the similarity to CVE-2022-25235 and raised the possibility of remote code execution impact, referencing a prior case where that vulnerability class was exploited for RCE in Zoom via Expat. The researcher, Kartik Kenchi, clarified that only a parser differential was confirmed and not RCE, but acknowledged the same missing-validation class could have downstream impact. The CVE was assigned by VulnCheck upon request from the maintainer. The pull request underwent a multi-month review process, including a deliberate delay during a declared security vacation period for the project (libexpat PR #1282).