CVE-2023-40031

CVE-2023-40031 Analysis and Reproduction of notepad++ Heap Buffer Overflow Vulnerability CVE-2023-40031 Vulnerability Overview Notepad++ is a well-known open-source code editor that runs on Windows and supports multiple programming languages. Recently, security researchers examined Notepad++ and...

OPENSUSE-SU-2026:22177-1 Security update for expat

This update for expat fixes the following issues: - CVE-2026-77214: out-of-bounds read due to insufficient checks in XMLParseBuffer bsc1284334. - CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input bsc1282347. - CVE-2026-102633: denial of service via integer...

CLSA-2026-1790252195 expat: Fix of 3 CVEs

CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, by adding LITTLE2/BIG2ISINVALIDCHAR and the matching little2/big2isInvalid4 vtable entries to the UTF-16 tokenizers in lib/xmltok.c, so a lone high surrogate can no longer consume the following code unit as a...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: expat (UTSA-2026-142355)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142355 advisory. Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can cra...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: expat (UTSA-2026-142303)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142303 advisory. Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can cra...

CVE-2026-92480

A flaw was found in the Linux kernel's SCSI Universal Flash Storage UFS core. This vulnerability arises from improper validation of string descriptors, which can lead to an out-of-bounds read when processing UTF-16 payloads. A local attacker or a malicious UFS device could exploit this to...

CentOS Linux 6 [TuxCare] Security Update: expat / expat-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791333112)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791333112 advisory. - Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in...

CVE-2026-107218

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where...

CVE-2026-107218

The Excelize Go language library (versions 2.10.1 to 2.11.0 ) is vulnerable to a denial-of-service condition where an attacker can trigger a panic during formula evaluation. The root cause is an improper validation of array index (CWE-129) within the RIGHT() function. Specifically, the library va...

CVE-2026-107218 Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where...

CVE-2026-107218

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length with UTF-16 code-unit counts but slices a rune array using Unicode code-point counts. RIGHT reaches leftRight through CalcCellValue, where...

CLSA-2026-1791333440 expat: Fix of 2 CVEs

CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...

CLSA-2026-1791333112 expat: Fix of 2 CVEs

CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...

expat: Fix of 2 CVEs

CVE-2026-66046: fix quadratic runtime in storeAtts by resolving an attribute's declared type through the default-attribute hash table instead of a linear scan of the element's default attributes - CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed...

CLSA-2026-1791254668 Fix CVE(s): CVE-2026-66046, CVE-2026-93990

SECURITY UPDATE: XML injection via malformed UTF-16 input: a high surrogate not followed by a low surrogate is accepted and consumes the following code unit, hiding markup characters from the parser libexpat through 2.8.4 - debian/patches/CVE-2026-93990.patch: reject a UTF-16 high surrogate whose...

CentOS Linux 7 [TuxCare] Security Update: expat / expat-devel / expat-static (CENTOS7:CLSA-2026:1790918446)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790918446 advisory. - Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences ...

CLSA-2026-1791195137 Fix CVE(s): CVE-2026-66046, CVE-2026-76641, CVE-2026-93990

SECURITY UPDATE: denial of service through quadratic runtime in the default-attribute lookup performed by storeAtts - debian/patches/CVE-2026-66046.patch: resolve whether an attribute is declared CDATA through the per-element defaultAttsNames hash table instead of a linear scan of defaultAtts in...

CLSA-2026-1790177624 expat: Fix of 2 CVEs

CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so a lone high surrogate can no longer consume the next code unit as a fake low and hide markup such as '' from the tokenizer...

FreeBSD : libexpat -- Improper Handling of Unicode Encoding (7fed71c4-be3a-11f1-ab8d-00a0980083d7)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7fed71c4-be3a-11f1-ab8d-00a0980083d7 advisory. https://github.com/libexpat/libexpat/pull/1282 reports: Expat before 2.8.5 fails to validate that a hig...

CLSA-2026-1790918446 expat: Fix of CVE-2026-93990

CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide the following code unit from the tokenizer...