Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: expat (UTSA-2026-142355)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142355 advisory. Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can cra...

CLSA-2026-1790919520 expat: Fix of CVE-2026-93990

CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide the following code unit from the tokenizer...

CVE-2026-93990: Improper Handling of Unicode Encoding

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...