ALPINE-CVE-2026-93990

ALPINE-CVE-2026-93990

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

CVSS 8.7 · High · Fix available

Published

2026-09-19T23:17:10.203Z

Updated

2026-10-18T10:30:02.727361388Z

Stack: system

Check your server →