ALPINE-CVE-2026-93990

ALPINE-CVE-2026-93990

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

CVSS 8.7 · Élevée · Correctif disponible

Publication

2026-09-19T23:17:10.203Z

Mise à jour

2026-10-18T10:30:02.727361388Z

Pile logicielle: system

Vérifiez votre serveur →