7.5Alta
CVE-2026-93990Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
Descripción
Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.
Debilidad (CWE):
CWE-176
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| libexpat | libexpat | < 2.8.5, fixed 2.8.5 | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.7 | |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.7 | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.7 | |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.7 | |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.7 |
Referencias y parches
- GitHub PR #1282 issue-trackingpatch
- https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a patch
- libexpat R_2_8_5 Release Notes release-notes
- https://blog.hartwork.org/posts/expat-2-8-5-released/ vendor-advisory
- https://github.com/libexpat/libexpat product
- VulnCheck Advisory: Expat through 2.8.4 Malformed UTF-16 Acceptance via Unchecked Surrogate third-party-advisory
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html