HackerFeeds

CyberSecurity News

Expat 2.8.5 released, fixes vulnerability CVE-2026-93990

Hacker News
· September 22, 2026
Vulnerabilities

AI summary

A new version of Expat, version 2.8.5, has been released. This update addresses a vulnerability, identified as CVE-2026-93990. The release is noted on a blog post and has been shared on Hacker News, where it has garnered some attention. Details about the vulnerability and the update can be found in the blog post.

Vulnerabilities mentioned

CVE-2026-93990
HIGH
CVSS 7.5

Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding markup characters from the parser and enabling XML injection attacks.

Read the full article at Hacker Newsblog.hartwork.org/posts/expat-2-8-5-released/

This is an AI-generated brief aggregated by HackerFeeds for convenience and grounded in the source’s own summary; the related CVE, threat-group and country data is from HackerFeeds’ own indexes. The original article is the authoritative source — all rights belong to Hacker News.