Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: expat (UTSA-2026-142355)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142355 advisory. Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can cra...

CLSA-2026-1790919520 expat: Fix of CVE-2026-93990

CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low surrogate, so malformed UTF-16 can no longer hide the following code unit from the tokenizer...

OESA-2026-4176 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16...

SUSE CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

EUVD-2026-83618

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and...

DEBIAN-CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

AZL-103316 CVE-2026-93990 affecting package expat 2.8.3-2

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

AZL-105099 CVE-2026-93990 affecting package ogdi 4.1.1-3

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

UBUNTU-CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-93990 Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-93990

Expat (libexpat) through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input. An attacker can craft UTF-16 encoded XML with lone high surrogates that consume subsequent code units, effectively hiding markup characters from the parser and enabling XML injection . The i...

CVE-2026-93990

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

CVE-2026-93990: Improper Handling of Unicode Encoding

Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpair...

PT-2026-95874

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.5 Description The software fails to validate low surrogates following high surrogates in UTF-16 input, which allows malformed UTF-16 sequences to be accepted. This behavior enables attackers to craft UTF-16 encoded...

CVE-2026-72522

CVE-2026-72522 affects libexpat before 2.8.3, where an out-of-bounds read and infinite loop occur because low surrogates are treated the same as high surrogates in the *_toUtf16 functions. The vulnerability is an availability issue (HIGH impact) with local attack requirements and no confidentiali...

SeBERTis: A Framework for Producing Classifiers of Security-Related Issue Reports

Monitoring issue tracker submissions is a crucial software maintenance activity. A key goal is the prioritization of high risk, security-related bugs. If such bugs can be recognized early, the risk of propagation to dependent products and endangerment of stakeholder benefits can be mitigated. To...

Seeking Flat Minima over Diverse Surrogates for Improved Adversarial Transferability: a Theoretical Framework and Algorithmic Instantiation

Whitepaper called Seeking Flat Minima Over Diverse Surrogates For Improved Adversarial Transferability: A Theoretical Framework And Algorithmic Instantiation...